Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.1
CVE-2026-101044: pnpm 12.0.0-alpha can write outside project
CVE-2026-101044 · published 1 month ago
Summary
Versions of pnpm between 12.0.0-alpha.0 and 12.0.0-alpha.4 may create files or links outside your project folder when an attacker supplies a malicious lockfile. This can let unwanted code be placed on your system. Upgrade to pnpm 12.0.0-alpha.5 or later, which checks and blocks such unsafe paths.
Original advisory text
pacquet, the Rust package-manager component shipped in the pnpm npm package versions >=12.0.0-alpha.0 and <12.0.0-alpha.5, does not validate dependency alias/name paths taken from a lockfile before...
pacquet, the Rust package-manager component shipped in the pnpm npm package versions >=12.0.0-alpha.0 and <12.0.0-alpha.5, does not validate dependency alias/name paths taken from a lockfile before using them in install-time filesystem joins. When a user installs a project with an attacker-supplied lockfile using --trust-lockfile or a frozen lockfile, alias entries containing path traversal segments (for example '../../escaped-link') are used when creating dependency and package links, bin destinations, hoisted entries, and virtual-store slots, allowing symlinks and directories to be created outside the intended project and node_modules boundary. Version 12.0.0-alpha.5 validates dependency names and every virtual-store slot path with a shared safe-join containment helper before any filesystem materialization, rejecting traversal, absolute, platform-specific, and reserved names with ERR_PNPM_INVALID_DEPENDENCY_NAME.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-22Path Traversal
Timeline
Published27 Sep 2026
Updated4 Nov 2026
First seen27 Sep 2026
Sources
CVE-2026-101044 · NVD
Track software like this
Free during beta