CVE-2026-24056: pnpm Symlink Traversal Vulnerability in File and Git Dependencies
Summary
CVE-2026-24056: pnpm has symlink traversal in file:/git dependencies. Affects pnpm versions < 10.28.2. Fixed in 10.28.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pnpm is a fast, disk space-efficient package manager for JavaScript and Node.js. It utilizes a unique symlink-based approach to manage dependencies, allowing for efficient storage and installation. However, this design can lead to vulnerabilities, particularly when handling local file and git dependencies, as demonstrated by CVE-2026-24056.
Vulnerability Detail
The vulnerability arises when pnpm installs dependencies specified as 'file:' or 'git:'. It follows symlinks without properly constraining them to the package root, allowing a malicious package to create symlinks to sensitive files on the system, such as '/etc/passwd' or '~/.ssh/id_rsa'. This can lead to unauthorized access to sensitive data, posing a significant risk to developers and CI/CD pipelines.
How To Fix
Latest published version: 12.15.0 as of 23 Oct 2026
npm install pnpm@12.15.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
10.28.2
This is the first release that contains the fix.
npm install pnpm@10.28.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using 'file:' or 'git:' dependencies that may contain symlinks pointing outside the package root. Instead, consider using published packages from the npm registry, which do not have this vulnerability.
Conclusion
CVE-2026-24056 highlights a significant vulnerability in pnpm related to symlink traversal in file and git dependencies. By updating to the latest version and following best practices, developers can mitigate the risks associated with this vulnerability.
See every vulnerability recorded for pnpm →
FAQ
Only 'file:' and 'git:' dependencies are affected. Registry packages from npm are not impacted as symlinks are stripped during publishing.
Installing a malicious package could lead to the leakage of sensitive local files, such as credentials or configuration files, which could compromise your system's security.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score for this vulnerability is 6.7, indicating a moderate level of risk.
Always keep your dependencies updated and be cautious when installing packages from untrusted sources. Regularly check for vulnerabilities using tools like Vulert.
References
Related vulnerabilities
Recent vulnerabilities recorded for pnpm.
