CVE Feed

    Dashboard / CVE / CVE-2026-101044

    CVE-2026-101044

    pacquet, the Rust package-manager component shipped in the pnpm npm package versions >=12.0.0-alpha.0 and <12.0.0-alpha.5, does not validate dependency alias/name paths taken from a lockfile before using them in install-time filesystem joins. When a user installs a project with an attacker-supplied lockfile using --trust-lockfile or a frozen lockfile, alias entries containing path traversal segments (for example '../../escaped-link') are used when creating dependency and package links, bin destinations, hoisted entries, and virtual-store slots, allowing symlinks and directories to be created outside the intended project and node_modules boundary. Version 12.0.0-alpha.5 validates dependency names and every virtual-store slot path with a shared safe-join containment helper before any filesystem materialization, rejecting traversal, absolute, platform-specific, and reserved names with ERR_PNPM_INVALID_DEPENDENCY_NAME.

    Published:Sep 27, 2026
    Last Modified:Sep 30, 2026
    EPS:Sep 27, 2026
    EPSS Score:0.00259
    CVSS Score:7.1

    Affected Products

    Vendor
    Pnpm
    Product
    Pnpm

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-101043 (CVSS 8.3) — pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand ${VAR} environment-variable placeholders …
    CVE-2026-82393 (CVSS 7.5) — pnpm is a package manager. Prior to 10.34.5 and 11.11.0, pnpm accepts a scoped path traversal in a tarball dep…
    CVE-2026-82392 (CVSS 7.1) — pnpm is a package manager. Prior to 10.34.5 and from 11.0.0 until 11.11.0, pnpm parses the package name from a…
    CVE-2026-59195 (CVSS 8.2) — pnpm is a package manager. Prior to 10.34.4 and 11.8.0, pnpm accepts package names from the env lockfile confi…
    CVE-2026-59196 (CVSS 7.1) — pnpm is a package manager. Prior to 10.34.4 and 11.7.0, a crafted lockfile alias could be joined directly unde…
    CVE-2026-59194 (CVSS 7.1) — pnpm is a package manager. Prior to 10.34.4 and 11.7.0, a crafted patch entry could resolve outside the config…
    CVE-2026-55180 (CVSS 6.5) — pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm and pacquet expanded ${ENV_VAR} placeholders from…
    CVE-2026-48995 (CVSS 4.8) — pnpm is a package manager. Prior to 10.33.4 and 11.0.7, a malicious codeload.github.com server can serve whate…
    CVE-2026-50017 (CVSS 6.9) — pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm can send user-level unscoped npm authentication c…
    CVE-2026-50016 (CVSS 8.8) — pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm allows a transitive dependency alias from registr…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High