CVE-2026-101044
Received Received - Intake

Path Traversal in pnpm pacquet

Publication date: 2026-09-27

Last updated on: 2026-09-27

Assigner: VulnCheck

Description
pacquet, the Rust package-manager component shipped in the pnpm npm package versions >=12.0.0-alpha.0 and <12.0.0-alpha.5, does not validate dependency alias/name paths taken from a lockfile before using them in install-time filesystem joins. When a user installs a project with an attacker-supplied lockfile using --trust-lockfile or a frozen lockfile, alias entries containing path traversal segments (for example '../../escaped-link') are used when creating dependency and package links, bin destinations, hoisted entries, and virtual-store slots, allowing symlinks and directories to be created outside the intended project and node_modules boundary. Version 12.0.0-alpha.5 validates dependency names and every virtual-store slot path with a shared safe-join containment helper before any filesystem materialization, rejecting traversal, absolute, platform-specific, and reserved names with ERR_PNPM_INVALID_DEPENDENCY_NAME.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-27
Last Modified
2026-09-27
Generated
2026-09-27
AI Q&A
2026-09-27
EPSS Evaluated
N/A
NVD
CVE-2026-101044
EUVD
EUVD-2026-87975

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
pnpm pacquet From 12.0.0-alpha.0 (inc) to 12.0.0-alpha.5 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-101044 is a path traversal vulnerability in pnpm versions >=12.0.0-alpha.0 and <12.0.0-alpha.5. It occurs when pacquet, the Rust package manager component, fails to validate dependency alias paths from a lockfile before using them in filesystem operations during installation. Attackers can exploit this by providing a malicious lockfile with path traversal sequences (e.g., '../../escaped-link') to create symlinks or directories outside the intended project or node_modules directory.

Detection Guidance

Check if your pnpm version is between 12.0.0-alpha.0 and <12.0.0-alpha.5 by running 'pnpm --version'. If vulnerable, inspect lockfiles for path traversal patterns like '../../' in dependency aliases. Use 'find node_modules -type l' to detect suspicious symlinks outside intended directories.

Impact Analysis

This vulnerability allows attackers to create symlinks or directories outside the project boundaries, potentially leading to unauthorized file access, arbitrary file writes, or code execution. Exploitation occurs when using --trust-lockfile or a frozen lockfile with a crafted lockfile, bypassing security controls and compromising system integrity.

Compliance Impact

This vulnerability could potentially violate compliance with GDPR and HIPAA by allowing unauthorized file access or system compromise through path traversal. Attackers could create symlinks outside intended directories, risking data exfiltration or modification. The lack of proper path validation in lockfiles may lead to unauthorized system access, which is a concern for data protection regulations.

Mitigation Strategies

Upgrade pnpm to version 12.0.0-alpha.5 or later using 'npm install -g pnpm@latest'. Avoid using '--trust-lockfile' or frozen lockfiles with untrusted projects. Review and remove any lockfiles from untrusted sources before installation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-101044. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart