Path Traversal Vulnerability in pacquet Component of pnpm Package

CVE-2026-101044

What is CVE-2026-101044?

The pacquet component within pnpm versions prior to 12.0.0-alpha.5 is vulnerable to path traversal attacks. This vulnerability arises when project installation utilizes an attacker-controlled lockfile. The component fails to validate dependency alias and name paths, potentially allowing the system to create malicious symlinks or directories outside of the designated project directory and node_modules boundary. This could lead to serious security implications, enabling attackers to manipulate the filesystem in unintended ways. It is crucial for users to upgrade to version 12.0.0-alpha.5 or later, where validation mechanisms have been implemented to mitigate these risks.

References