CVE-2026-59195

Name of the Vulnerable Software and Affected Versions pnpm versions prior to 10.34.4 pnpm versions prior to 11.8.0

Description pnpm accepts package names from the configDependencies section of the env lockfile and uses them directly when creating config dependency symlinks under node modules/.pnpm-config. A malicious repository can commit a crafted pnpm-lock.yaml file where the env-lockfile document contains a traversal-shaped config dependency name. During the installation process, pnpm creates a symlink at a path derived from that name, which can lead to path traversal.

Recommendations Update to version 10.34.4. Update to version 11.8.0.