A flaw was found in pnpm. The package manager does not properly sanitize dependency names and alias paths specified within project lockfiles. By convincing a user or build system to install a project containing a crafted lockfile, an attacker can exploit this path traversal issue to create directories and symbolic links outside the intended project directory. This flaw can lead to unauthorized file manipulation and compromise the integrity of the host system.
Last checked: 2026-09-30 19:21 UTC
No exploitation evidence · CISA Coordinator (Assessed 2026-09-30 15:28 UTC)
Fix evidence last checked: 2026-10-02 00:59 UTC