IA Squad
SearchPT
js · pnpmCritical

pnpm: Path traversal via transitive dependency alias allows symlink replacement

pnpm allows a transitive dependency alias from registry package metadata to contain path traversal segments, which during install is used as a filesystem path when linking dependency nodes, enabling symlink replacement of project paths (e.

27 Jun 2026Read 1 minSeverity: act now

What changed

pnpm allows a transitive dependency alias from registry package metadata to contain path traversal segments, which during install is used as a filesystem path when linking dependency nodes, enabling symlink replacement of project paths (e.g., .git/hooks) with attacker-controlled directories.

Who it affects

All users of pnpm who run `pnpm install --ignore-scripts` and install packages with transitive dependencies that have malicious aliases.

What to do today

Update pnpm to a patched version as soon as one is available; in the meantime, avoid installing untrusted packages or use a lockfile and verify dependency aliases.

The trail
Collected Audited Written Published