CVE-2026-24056mediumCWE-22CWE-59

CVE-2026-24056: medium-severity vulnerability in pnpm

pnpm has symlink traversal in file:/git dependencies

Published · Updated

Follow this CVE+ Monitor pnpm+ Monitor pnpm

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.7epss 0.5%
pnpm is a package manager. Prior to version 10.28.2, when pnpm installs a `file:` (directory) or `git:` dependency, it follows symlinks and reads their target contents without constraining them to the package root. A malicious package containing a symlink to an absolute path (e.g., `/etc/passwd`, `~/.ssh/id_rsa`) causes pnpm to copy that file's contents into `node_modules`, leaking local data. The vulnerability only affects `file:` and `git:` dependencies. Registry packages (npm) have symlinks stripped during publish and are NOT affected. The issue impacts developers installing local/file dependencies andCI/CD pipelines installing git dependencies. It can lead to credential theft via symlinks to `~/.aws/credentials`, `~/.npmrc`, `~/.ssh/id_rsa`. Version 10.28.2 contains a patch.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
pnpm · pnpm
Related CVEs — pnpm

In the same product, most dangerous first.

CVE-2023-37478HIGHpnpm incorrectly parses tar archives relative to specificationEPSS 1.2%CVE-2025-69262HIGHpnpm vulnerable to Command Injection via environment variable substitutionEPSS 1.0%CVE-2025-69264HIGHpnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default"EPSS 1.0%CVE-2024-53866MEDIUMpnpm vulnerable to no-script global cache poisoning via overrides / `ignore-scripts` evasionEPSS 1.0%CVE-2026-82393HIGHpnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on installEPSS 0.6%CVE-2026-82392HIGHpnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraphEPSS 0.6%