CVE-2026-101044 pnpm CVE debrief

Who should care

Developers using pnpm, especially those who use --trust-lockfile or frozen lockfiles, should assess exposure and apply patches. System administrators and security teams should verify inventory of projects using pnpm and monitor for suspicious activity related to pnpm installations.

Why it matters

CVE-2026-101044 is a high-severity vulnerability in pnpm that allows for path traversal attacks. Developers and security teams should assess exposure, apply patches, and monitor for suspicious activity.

• Potential creation of symlinks and directories outside the intended project and node_modules boundary
• Possible elevation of privileges or unauthorized access to sensitive data
• Need for verification of pnpm versions and lockfile usage
• Requirement for patching or upgrading to version 12.0.0-alpha.5 or later

Technical summary

The pacquet component in pnpm npm package versions >=12.0.0-alpha.0 and <12.0.0-alpha.5 does not validate dependency alias/name paths from a lockfile before using them in install-time filesystem joins. This can lead to path traversal attacks when a user installs a project with an attacker-supplied lockfile using --trust-lockfile or a frozen lockfile. The vulnerability allows for the creation of symlinks and directories outside the intended project and node_modules boundary. Developers and security teams should assess exposure, apply patches, and monitor for suspicious activity.

Defensive priority

High priority for developers using pnpm, especially those who use --trust-lockfile or frozen lockfiles, to assess exposure and apply patches.

Recommended defensive actions

• Assess exposure by reviewing pnpm versions and lockfile usage
• Apply patches or upgrade to version 12.0.0-alpha.5 or later
• Verify inventory of projects using pnpm and --trust-lockfile or frozen lockfiles
• Monitor for suspicious activity related to pnpm installations
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but the scope of affected versions and deployments requires further verification. The pacquet component in pnpm npm package versions >=12.0.0-alpha.0 and <12.0.0-alpha.5 does not validate dependency alias/name paths from a lockfile before using them in install-time filesystem joins. This can lead to path traversal attacks when a user installs a project with an attacker-supplied lockfile using --trust-lockfile or a frozen lockfile. The CVE Program record and NVD entry

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.