CVE-2026-59196: pnpm: hoisted install imports lockfile alias outside node_modules

Q: What is the severity of CVE-2026-59196?

The severity of CVE-2026-59196 is rated as high with a score of 7.1.

Q: How do I fix CVE-2026-59196?

To fix CVE-2026-59196, upgrade pnpm to version 10.34.4 or later, or 11.7.0 or later.

Q: What type of vulnerability is CVE-2026-59196?

CVE-2026-59196 is classified as a Path Traversal vulnerability.

Q: Which package manager is affected by CVE-2026-59196?

The package manager affected by CVE-2026-59196 is pnpm.

Q: When was CVE-2026-59196 published?

CVE-2026-59196 was published on July 6, 2026.

Published Jul 6, 2026

Updated

pnpm is a package manager. Prior to 10.34.4 and 11.7.0, a crafted lockfile alias could be joined directly under a hoisted nodemodules directory. Traversal aliases could escape that directory, while reserved aliases such as .bin or .pnpm could overwrite pnpm-owned layout. This vulnerability is fixed in 10.34.4 and 11.7.0.

Affected Software

3 affected components

pnpm>10.34.4<=11.7.0

PNPM Pnpm Node.js<10.34.4

PNPM Pnpm Node.js>=11.0.0<11.7.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade pnpm to a version that resolves this vulnerability.
Fixed in 10.34.4
Upgrade
Upgrade pnpm to a version that resolves this vulnerability.
Fixed in 11.7.0

Event History

Jul 6, 2026

CVE Published

via MITRE·03:18 PM

Data Sourced

via MITRE·03:18 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:16 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2026-59196?

The severity of CVE-2026-59196 is rated as high with a score of 7.1.

How do I fix CVE-2026-59196?

To fix CVE-2026-59196, upgrade pnpm to version 10.34.4 or later, or 11.7.0 or later.

What type of vulnerability is CVE-2026-59196?

CVE-2026-59196 is classified as a Path Traversal vulnerability.

Which package manager is affected by CVE-2026-59196?