Path Traversal in pnpm Package Manager

Executive Summary

CVE-2026-59196 is a high-severity vulnerability in pnpm and pacquet package managers affecting versions below 10.34.4 and between 11.0.0 to 11.6.9. The issue arises from a crafted lockfile alias that can bypass security boundaries in hoisted node_modules directories.

Specifically, traversal aliases could escape the intended node_modules directory, and reserved aliases like .bin or .pnpm could overwrite pnpm-owned layout directories. This happens due to improper validation of package names and path containment before filesystem operations.

The vulnerability allows attackers to access or modify files outside the intended scope by exploiting path traversal and external control of file names or paths.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves identifying pnpm or pacquet installations running vulnerable versions below 10.34.4 and between 11.0.0 to 11.6.9 for pnpm, or below 11.7.0 for pacquet.

You can check the installed version of pnpm or pacquet with the following commands:

• pnpm --version
• pacquet --version

Additionally, to detect potential exploitation attempts, you can scan your project directories for suspicious lockfile aliases that include traversal patterns or reserved names such as `.bin` or `.pnpm`.

For example, you might search for traversal aliases in lockfiles using commands like:

• grep -rE '(\.\./|/\.\./|\.bin|\.pnpm)' path/to/your/project

Monitoring filesystem changes outside the expected `node_modules` directory could also indicate exploitation attempts.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing unauthorized access or modification of files outside the intended node_modules directory.

An attacker could overwrite critical directories such as .bin or .pnpm, potentially compromising the integrity of your package manager's layout and operations.

The CVSS score of 7.1 indicates a high impact on integrity and a moderate impact on availability, meaning your system's data integrity could be seriously affected and availability could be somewhat impacted.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade pnpm to version 10.34.4 or later, or to version 11.7.0 or later if you are using the 11.x series.

Similarly, if you are using pacquet, upgrade to version 11.7.0 or later.

These versions include fixes that reject traversal, absolute, or reserved package names, preventing exploitation by enforcing strict containment rules during filesystem operations.

Useful 0 Not Useful 0