CVE-2026-101044 pacquet before 12.0.0-alpha.5 Path Traversal via lockfile alias
Attackers can create files outside project boundaries via malicious lockfile aliases, potentially leading to code execution or data modification.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-101044?
CVE-2026-101044 is a high-severity path traversal vulnerability in pnpm, published on 27 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
pacquet, the Rust package-manager component shipped in the pnpm npm package versions >=12.0.0-alpha.0 and <12.0.0-alpha.5, does not validate dependency alias/name paths taken from a lockfile before using them in install-time filesystem joins. When a user installs a project with an attacker-supplied lockfile using --trust-lockfile or a frozen lockfile, alias entries containing path traversal segments (for example '../../escaped-link') are used when creating dependency and package links, bin destinations, hoisted entries, and virtual-store slots, allowing symlinks and directories to be created outside the intended project and node_modules boundary. Version 12.0.0-alpha.5 validates dependency names and every virtual-store slot path with a shared safe-join containment helper before any filesystem materialization, rejecting traversal, absolute, platform-specific, and reserved names with ERR_PNPM_INVALID_DEPENDENCY_NAME.
Weakness: CWE-22
Which versions are affected by CVE-2026-101044?
How do I fix CVE-2026-101044?
No fix has been published for CVE-2026-101044 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-101044 being exploited?
There is no known exploitation of CVE-2026-101044 in the wild and no public exploit code.
Sources
Also known as GHSA-qj85-gv7w-fqmr.