CVE-2026-24056: pnpm has symlink traversal in file /git Dependencies Vulnerability
MODERATECVE-2026-24056 is a MODERATE (CVSS 6.5) /git dependencies vulnerability (CWE-59: Improper Link Resolution Before File Access ('Link Following')) affecting pnpm has symlink traversal in file libraries in the npm ecosystem. The issue involves /git dependencies. Remediation is available by upgrading affected packages to version 10.28.2.
CVE-2026-24056 at a Glance
Security Impact
CVSS: 6.5
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N).
How to Fix CVE-2026-24056
To remediate this vulnerability, upgrade all affected pnpm has symlink traversal in file dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
npm install pnpm@10.28.2Run the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls pnpmHow to Check if You Are Affected
To determine whether your Node.js application is affected by CVE-2026-24056, inspect your project dependencies using npm:
npm ls pnpmAnalyze the terminal output to locate any version of pnpm has symlink traversal in file in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 10.28.2), your application is affected.
Note: The npm ls pnpm command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-59: Improper Link Resolution Before File Access ('Link Following'), where the product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource. In pnpm has symlink traversal in file, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-24056 Affected pnpm has symlink traversal in file Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
pnpm
|
npm |
< 10.28.2
|
10.28.2
|
References
Frequently Asked Questions
What is CVE-2026-24056?
Which pnpm has symlink traversal in file versions are affected?
What version fixes CVE-2026-24056?
Is pnpm affected?
What is the CVSS score of CVE-2026-24056?
What CWE is associated with CVE-2026-24056?
How can I check npm dependencies for CVE-2026-24056?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-m733-5w8f-5ggw",
"modified" : "2026-01-29T03:23:22Z",
"published" : "2026-01-26T21:02:33Z",
"aliases" : [ "CVE-2026-24056" ],
"summary" : "pnpm has symlink traversal in file:/git dependencies",
"details" : "### Summary\nWhen pnpm installs a `file:` (directory) or `git:` dependency, it follows symlinks and reads their target contents without constraining them to the package root. A malicious package containing a symlink to an absolute path (e.g., `/etc/passwd`, `~/.ssh/id_rsa`) causes pnpm to copy that file's contents into `node_modules`, leaking local data.\n\n**Preconditions:** Only affects `file:` and `git:` dependencies. Registry packages (npm) have symlinks stripped during publish and are NOT affected.\n\n### Details\nThe vulnerability exists in `store/cafs/src/addFilesFromDir.ts`. The code uses `fs.statSync()` and `readFileSync()` which follow symlinks by default:\n\n```typescript\nconst absolutePath = path.join(dirname, relativePath)\nconst stat = fs.statSync(absolutePath) // Follows symlinks!\nconst buffer = fs.readFileSync(absolutePath) // Reads symlink TARGET\n```\n\nThere is no check that `absolutePath` resolves to a location inside the package directory.\n\n### PoC\n```bash\n# Create malicious package\nmkdir -p /tmp/evil && cd /tmp/evil\nln -s /etc/passwd leaked-passwd.txt\necho '{\"name\":\"evil\",\"version\":\"1.0.0\",\"files\":[\"*.txt\"]}' > package.json\n\n# Victim installs\nmkdir /tmp/victim && cd /tmp/victim\npnpm init && pnpm add file:../evil\n\n# Leaked!\ncat node_modules/evil/leaked-passwd.txt\n```\n\n### Impact\n- Developers installing local/file dependencies\n- CI/CD pipelines installing git dependencies\n- Credential theft via symlinks to `~/.aws/credentials`, `~/.npmrc`, `~/.ssh/id_rsa`\n\n### Suggested Fix\nUse `lstatSync` to detect symlinks and reject those pointing outside the package root in `store/cafs/src/addFilesFromDir.ts`.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
}, {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "pnpm"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "10.28.2"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/pnpm/pnpm/security/advisories/GHSA-m733-5w8f-5ggw"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-24056"
}, {
"type" : "WEB",
"url" : "https://github.com/pnpm/pnpm/commit/b277b45bc35ae77ca72d7634d144bbd58a48b70f"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/pnpm/pnpm"
}, {
"type" : "WEB",
"url" : "https://github.com/pnpm/pnpm/releases/tag/v10.28.2"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-22", "CWE-59" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2026-01-26T21:02:33Z",
"nvd_published_at" : "2026-01-26T22:15:56Z"
}
}