Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-07-06T15:21:03 pnpm: pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L

pnpm is a package manager. Prior to 10.34.4 and 11.8.0, pnpm accepts package names from the env lockfile configDependencies section and uses those names directly when creating config dependency symlinks under node_modules/.pnpm-config. A malicious repository can commit a crafted pnpm-lock.yaml whose env-lockfile document contains a traversal-shaped config dependency name. During pnpm install, pnpm installs the config dependency and creates a symlink at a path derived from that name. This vulnerability is fixed in 10.34.4 and 11.8.0.

A flaw was found in pnpm, a package manager. A remote attacker could exploit a path traversal vulnerability by crafting a malicious `pnpm-lock.yaml` file. When a user installs dependencies from such a repository, pnpm incorrectly processes package names from the `configDependencies` section, leading to the creation of symbolic links outside the intended directory. This allows an attacker to achieve arbitrary file writes within the victim's project directory, potentially extending to other areas of the filesystem.

This is an Important path traversal vulnerability in pnpm, a package manager used by Red Hat products such as Red Hat Build of Keycloak, Enterprise Application Platform, Red Hat AMQ, and Konflux. A malicious repository containing a specially crafted `pnpm-lock.yaml` file can lead to the creation of arbitrary symlinks outside the intended `node_modules/.pnpm-config` directory during `pnpm install`. This provides an attacker with a filesystem write primitive, even when `--ignore-scripts` is used, increasing the risk of unauthorized file manipulation. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat AMQ Broker 7 Not affected pnpm Red Hat Build of Keycloak Affected pnpm Red Hat JBoss Enterprise Application Platform 8 Not affected pnpm Red Hat JBoss Enterprise Application Platform Expansion Pack Not affected pnpm https://www.cve.org/CVERecord?id=CVE-2026-59195 https://nvd.nist.gov/vuln/detail/CVE-2026-59195 https://github.com/pnpm/pnpm/security/advisories/GHSA-qrv3-253h-g69c