CVE-2026-59196 Details
Description
pnpm is a package manager. Prior to 10.34.4 and 11.7.0, a crafted lockfile alias could be joined directly under a hoisted node_modules directory. Traversal aliases could escape that directory, while reserved aliases such as .bin or .pnpm could overwrite pnpm-owned layout. This vulnerability is fixed in 10.34.4 and 11.7.0.
A vulnerability in pnpm, a package manager, allows for directory traversal through crafted lockfile aliases. This issue is present in pnpm versions prior to 10.34.4 and in the 11.0.0 to 11.7.0 range. The vulnerability arises because an alias could be joined directly under a hoisted node_modules directory, with traversal aliases capable of escaping that directory. Additionally, reserved aliases like .bin or .pnpm could overwrite pnpm-owned layout. The vulnerability has been addressed by validating package-name semantics and path containment before inserting into the dependency graph or performing filesystem operations.
Users can update to pnpm versions 10.34.4 or 11.7.0 and later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pnpm/pnpm/security/advisories/GHSA-fr4h-3cph-29xv | [email protected] | Vendor AdvisoryExploit |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
| CWE-73 | External Control of File Name or Path | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| pnpm pnpm | < 10.34.4 >= 11.0.0, < 11.7.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 7, 2026 | Initial Analysis | [email protected] |
| Jul 6, 2026 | CVE Modified | CISA-ADP |
| Jul 6, 2026 | New CVE Received | [email protected] |