CVE-2026-59195: pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config
pnpm is a package manager. Prior to 10.34.4 and 11.8.0, pnpm accepts package names from the env lockfile configDependencies section and uses those names directly when creating config dependency symlinks under nodemodules/.pnpm-config. A malicious repository can commit a crafted pnpm-lock.yaml whose env-lockfile document contains a traversal-shaped config dependency name. During pnpm install, pnpm installs the config dependency and creates a symlink at a path derived from that name. This vulnerability is fixed in 10.34.4 and 11.8.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pnpmto a version that resolves this vulnerability.Fixed in 10.34.4 - Upgrade
Upgrade
pnpmto a version that resolves this vulnerability.Fixed in 11.8.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-59195?
CVE-2026-59195 has a severity rating of 8.2, which is categorized as high.
How do I fix CVE-2026-59195?
To fix CVE-2026-59195, upgrade pnpm to version 10.34.4 or later, or to version 11.8.0 or later.
What type of vulnerability is CVE-2026-59195?
CVE-2026-59195 is a path traversal vulnerability that allows symlink creation outside the intended directory.
What are the potential impacts of CVE-2026-59195?
The potential impacts of CVE-2026-59195 include unauthorized file access and manipulation, which can lead to further exploitation.
Which software is affected by CVE-2026-59195?
CVE-2026-59195 affects the pnpm package manager versions prior to 10.34.4 and 11.8.0.