CVE-2026-59196 pnpm Lockfile Traversal and Directory Overwrite Vulnerability

Technical summary

The vulnerability stems from insufficient validation of alias names in pnpm lockfiles during the hoisted module resolution phase. Lockfile aliases are parsed and joined into the node_modules directory structure without proper sanitization. Two distinct attack vectors emerge: (1) Path traversal aliases that escape the intended hoisted directory hierarchy (CWE-22), and (2) Reserved alias names such as '.bin' or '.pnpm' that collide with pnpm's internal layout directories (CWE-73). When a crafted lockfile contains such aliases, they are written directly into the filesystem with the privileges of the user running pnpm, potentially corrupting the dependency tree or injecting malicious executables into reserved directories that pnpm uses for its own operations.

Business impact

This vulnerability primarily affects development and CI/CD pipelines where pnpm is used. A developer or automated build system that installs dependencies from a compromised lockfile could have their node_modules directory corrupted, resulting in broken builds, unexpected behavior, or execution of injected code. Organizations relying on pnpm for supply chain tooling face elevated risk if lockfiles are pulled from untrusted sources or if repositories have been compromised. The impact is contained to the affected machine's node_modules and build artifacts, but in CI/CD contexts, this could propagate compromised packages downstream. The HIGH severity reflects the combination of high integrity impact and ease of exploitation via file manipulation.

Affected systems

pnpm versions 10.34.3 and earlier (in the 10.x line) and 11.6.0 and earlier (in the 11.x line) are vulnerable. Any system using pnpm to install Node.js dependencies is at risk if it processes a malicious or compromised lockfile. This includes local development environments, CI/CD runners (GitHub Actions, GitLab CI, Jenkins, etc.), Docker build stages, and any automation that invokes pnpm install or pnpm ci with user-supplied or untrusted lockfiles.

Exploitability

Exploitability is straightforward from a technical standpoint: an attacker need only craft a malicious pnpm-lock.yaml or pnpm-lock.json file with crafted alias entries and place it in a repository or supply chain. The CVSS vector (AV:N/AC:L/PR:N/UI:R) indicates network-accessible, low complexity, no privileges required, but user interaction needed. The user interaction is simply running pnpm install or a CI job that does so. No advanced techniques or zero-day exploitation is required; the attack is deterministic once the lockfile is introduced. However, the vulnerability does not propagate automatically—it requires the user to execute pnpm against the malicious lockfile, which limits opportunistic large-scale exploitation but makes targeted supply chain attacks highly viable.

Remediation

Upgrade pnpm to version 10.34.4 or later (for the 10.x series) or 11.7.0 or later (for the 11.x series). These versions include input validation fixes for lockfile alias parsing that reject or safely handle traversal and reserved directory names. After upgrading, regenerate lockfiles from trusted sources (via pnpm install on a clean, trusted machine) and review any lockfiles that may have been processed by vulnerable versions for signs of tampering.

Patch guidance

1. Identify all systems and pipelines using pnpm. Check pnpm version with 'pnpm --version'. 2. Prioritize CI/CD and shared development environments. 3. Upgrade pnpm globally or per-project to the patched versions: run 'pnpm add -g pnpm@latest' or update package.json and package-lock files accordingly. 4. For monorepo or workspace setups, ensure the root pnpm version is updated. 5. After upgrading, run 'pnpm install' or 'pnpm ci' to regenerate or validate lockfiles. 6. If lockfiles were modified or created before patching, audit them for suspicious alias entries or manually verify their integrity from VCS history.

Detection guidance

Look for lockfile commits or changes that introduce unusual alias entries, especially those containing path separators ('/', '\'), dots ('..'), or reserved directory names ('.bin', '.pnpm', etc.). In CI/CD logs, monitor for pnpm install failures or unexpected file writes outside the node_modules tree. Use file integrity monitoring (e.g., auditd on Linux) to catch unexpected writes during pnpm execution. Code review processes should flag lockfile changes with scrutiny equal to package.json changes. In Git, inspect lockfile diffs for suspicious alias entries: 'git log -p pnpm-lock.yaml | grep -E "alias|\.\."'.

Why prioritize this

Prioritize patching because: (1) pnpm is integral to modern Node.js development ecosystems; (2) lockfiles are frequently synchronized across teams and CI/CD, amplifying supply chain risk; (3) the attack requires no authentication and only user interaction to trigger; (4) CI/CD automation means lockfiles may be processed without human review; (5) the vulnerability enables file overwriting and code injection, which are high-integrity impacts. Organizations with strict supply chain security postures should treat this as a medium-term priority (patch within 2-4 weeks). Those with high exposure in CI/CD or public-facing development should expedite to 1-2 weeks.

Risk score, explained

CVSS 7.1 (HIGH) reflects: high integrity impact (I:H) from file overwriting and layout corruption, low availability impact (A:L) from potential build failures, but no confidentiality impact (C:N) since the vulnerability does not leak data. The network and low-complexity vector indicates the attack can originate remotely and requires minimal attacker sophistication. User interaction (lockfile installation) is a mitigating factor but not a strong one in automated CI/CD contexts. The score appropriately captures a real but not critical threat—organizations can mitigate through access controls on lockfiles and rapid patching.

Frequently asked questions