# GHSA-2rx9-3g3h-c2jv: pnpm: pacquet trust-lockfile install can create dependency symlinks outside the project

> Attackers can create symlinks outside project directories via crafted lockfiles when using trust-lockfile or frozen install modes.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** Not needed
- **Attackable:** Local or same network only
- **Victim action needed:** A user has to click or open something
- **Fix available:** Yes
- **Published:** 1 Sep 2026

## What is GHSA-2rx9-3g3h-c2jv?

GHSA-2rx9-3g3h-c2jv is a path traversal vulnerability in pnpm, published on 1 Sep 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

### Official description

## Summary

A crafted lockfile alias could reach several install-time filesystem joins. With `--trust-lockfile` or a frozen lockfile, traversal segments could create links outside the intended project or `node_modules` boundary. This patch validates dependency names and every virtual-store slot before creating directories, links, bins, or hoisted entries.

## Security boundary

- A shared safe-join helper rejects traversal, absolute, platform-specific, and reserved dependency names before filesystem materialization.
- Direct and transitive dependency links, package links, bin destinations, and public/private hoist destinations use the same containment rule.
- Global virtual-store slots validate the complete slot path, including version-derived components, before directory creation.
- Snapshot slots and package names are checked before store initialization and before the current-lockfile fast path, closing the warm-install bypass.
- Rejections preserve `ERR_PNPM_INVALID_DEPENDENCY_NAME`.

## Exploit replay

Before the patch, `pacquet install --frozen-lockfile --trust-lockfile` accepted a `../../escaped-link` dependency key and created a symlink outside the project. With this patch, the same lockfile is rejected before materialization and no outside link is created.

## Files changed

- `pacquet/crates/package-manager/src/safe_join_modules_dir.rs` defines the shared containment rule.
- Install, symlink, bin, hoist, virtual-store, and frozen-lockfile paths call that helper before filesystem materialization.
- The corresponding `tests.rs` files cover every sink, including warm installs and global virtual-store slots.

## Commands run

```text
$ cargo test --locked -p pacquet-package-manager --lib
PASS: 434 tests
$ cargo clippy --locked -p pacquet-package-manager --all-targets -- --deny warnings
PASS
$ cargo fmt --all -- --check
PASS
```

## Validation

- Full pacquet package-manager suite: 434 passed.
- Focused regressions cover direct and transitive aliases, bins, hoists, package names, global virtual-store version traversal, and a poisoned prior-install slot.
- `cargo clippy -p pacquet-package-manager --all-targets -- -D warnings`: passed.
- `cargo fmt --all -- --check` and `git diff --check`: passed.

## Compatibility

Valid unscoped and scoped dependency aliases continue to work. The reproduced escape was specific to pacquet, so this branch does not change the TypeScript CLI or the lockfile format.

---
Written by an agent (Codex, GPT-5).

## Which versions are affected by GHSA-2rx9-3g3h-c2jv?

2 open source packages ship an affected version, including pnpm.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `pnpm` | npm | From 12.0.0-alpha.0 | 12.0.0-alpha.5 |
| `pnpm` | npm | From 12.0.0-alpha.0 | 12.0.0-alpha.5 |

## How do I fix GHSA-2rx9-3g3h-c2jv?

Upgrade pnpm to 12.0.0-alpha.5 or later.

## Is GHSA-2rx9-3g3h-c2jv being exploited?

There is no known exploitation of GHSA-2rx9-3g3h-c2jv in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for GHSA-2rx9-3g3h-c2jv and fix it if it is affected.

What it is: GHSA-2rx9-3g3h-c2jv is a path traversal vulnerability in pnpm, published on 1 Sep 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Exploitation: There is no known exploitation of GHSA-2rx9-3g3h-c2jv in the wild and no public exploit code.

Affected packages and fixed versions:
- pnpm (npm): affected from 12.0.0-alpha.0; fixed in 12.0.0-alpha.5
- pnpm (npm): affected from 12.0.0-alpha.0; fixed in 12.0.0-alpha.5

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/GHSA-2rx9-3g3h-c2jv/ (Markdown: https://insights.sbomify.com/GHSA-2rx9-3g3h-c2jv/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/GHSA-2rx9-3g3h-c2jv

---
From sbomify Insights: https://insights.sbomify.com/GHSA-2rx9-3g3h-c2jv/
Summaries are generated and may contain mistakes; the official description above is the record.