Symlink Vulnerability in pnpm Package Manager

CVE-2026-24056

What is CVE-2026-24056?

The pnpm package manager has a vulnerability that allows it to follow symlinks leading to absolute paths when installing 'file:' or 'git:' dependencies. If a malicious package is introduced containing a symlink, it can inadvertently expose sensitive local files, such as user credentials or SSH keys, into the 'node_modules' directory. This risk is particularly alarming for developers and CI/CD pipelines, as it opens the door to credential theft and data leaks. The issue has been addressed in version 10.28.2, which is a crucial update for users relying on pnpm for dependency management.

References