CVE-2022-26183 Untrusted Search Path in PNPM

What is CVE-2022-26183?

CVE-2022-26183 is a high-severity path traversal vulnerability in n/a, published on 21 Mar 2022. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

PNPM v6.15.1 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute PNPM commands in a directory containing malicious content. This vulnerability occurs when the application is ran on Windows OS.

Weakness: CWE-426

Which versions are affected by CVE-2022-26183?

2 open source packages ship an affected version, including pnpm. It affects 1 product.

Products include Pnpm Pnpm.

How do I fix CVE-2022-26183?

Upgrade pnpm to 6.15.1 or later.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2022-26183 being exploited?

There is no known exploitation of CVE-2022-26183 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2026-50016 pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement High 8.8
• CVE-2026-55698 pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes High 8.8
• CVE-2025-69264 pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default" High 8.8
• CVE-2026-59195 pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config High 8.2
• CVE-2025-69262 pnpm vulnerable to Command Injection via environment variable substitution High 7.6

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-9m87-6fj3-c5xh.