CVE-2022-26183: Untrusted Search Path in PNPM
Summary
CVE-2022-26183: Untrusted Search Path in PNPM. Affects pnpm versions < 6.15.1. Fixed in 6.15.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PNPM is an open-source package manager for JavaScript projects. It allows developers to efficiently manage dependencies and install packages. PNPM is widely used in the Node.js ecosystem. However, prior to version 6.15.1, PNPM was found to have a vulnerability that could be exploited when executed on Windows OS. This vulnerability arises from an untrusted search path, which can lead to unexpected behavior when running PNPM commands in a directory containing malicious content.
Vulnerability Detail
The untrusted search path vulnerability in PNPM allows an attacker to manipulate the application's behavior by placing malicious files in a directory where PNPM commands are executed. This can lead to various consequences, such as arbitrary code execution, privilege escalation, or data compromise. The vulnerability has a CVSS score of 8.8, indicating a high severity level. It is important to note that this vulnerability only affects PNPM versions prior to 6.15.1.
How To Fix
Latest published version: 12.15.0 as of 23 Oct 2026
npm install pnpm@12.15.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.15.1
This is the first release that contains the fix.
npm install pnpm@6.15.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating PNPM is not immediately feasible, a workaround is to avoid executing PNPM commands in directories that may contain untrusted or malicious content. Developers should exercise caution and ensure that the directories used for PNPM operations are secure and free from any potentially harmful files.
Conclusion
The untrusted search path vulnerability in PNPM can have serious consequences if exploited by an attacker. It is crucial to update PNPM to version 6.15.1 or later to mitigate this vulnerability. Additionally, developers should exercise caution when executing PNPM commands and ensure the directories used are secure. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for pnpm →
FAQ
PNPM is an open-source package manager for JavaScript projects. It provides a fast and efficient way to manage dependencies and install packages in Node.js applications.
The untrusted search path vulnerability in PNPM can allow an attacker to manipulate the application's behavior and potentially execute arbitrary code, escalate privileges, or compromise data.
This vulnerability affects PNPM versions prior to 6.15.1. It is recommended to update to version 6.15.1 or later to mitigate the risk.
To update PNPM, you can run the command 'npm install -g pnpm@6.15.1'. This will install the latest version of PNPM, which includes a fix for the vulnerability.
If updating PNPM is not immediately possible, you can mitigate the risk by avoiding executing PNPM commands in directories that may contain untrusted or malicious content.
Related vulnerabilities
Recent vulnerabilities recorded for pnpm.
