CVE-2026-59195 Details
Description
pnpm is a package manager. Prior to 10.34.4 and 11.8.0, pnpm accepts package names from the env lockfile configDependencies section and uses those names directly when creating config dependency symlinks under node_modules/.pnpm-config. A malicious repository can commit a crafted pnpm-lock.yaml whose env-lockfile document contains a traversal-shaped config dependency name. During pnpm install, pnpm installs the config dependency and creates a symlink at a path derived from that name. This vulnerability is fixed in 10.34.4 and 11.8.0.
A path traversal vulnerability has been identified in pnpm, a package manager, affecting versions prior to 10.34.4 and 11.8.0. The issue arises because pnpm accepts package names from the env lockfile's configDependencies section and directly uses these names to create symlinks for config dependencies under node_modules/.pnpm-config. This vulnerability can be exploited by a malicious repository that includes a crafted pnpm-lock.yaml file with a traversal-shaped config dependency name. During the pnpm install process, the package manager installs the config dependency and creates a symlink at a path derived from the name, potentially leading to unauthorized access or modification of files outside the intended directory.
Users can update to pnpm versions 10.34.4 or 11.8.0 and later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pnpm/pnpm/security/advisories/GHSA-qrv3-253h-g69c | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/pnpm/pnpm/security/advisories/GHSA-qrv3-253h-g69c | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| pnpm pnpm | < 10.34.4 >= 11.0.0, < 11.8.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 7, 2026 | Initial Analysis | [email protected] |
| Jul 7, 2026 | CVE Modified | CISA-ADP |
| Jul 6, 2026 | New CVE Received | [email protected] |