CVE-2026-101044

pacquet before 12.0.0-alpha.5 Path Traversal via lockfile alias

Published Sep 27, 2026 CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Description

pacquet, the Rust package-manager component shipped in the pnpm npm package versions >=12.0.0-alpha.0 and <12.0.0-alpha.5, does not validate dependency alias/name paths taken from a lockfile before using them in install-time filesystem joins. When a user installs a project with an attacker-supplied lockfile using --trust-lockfile or a frozen lockfile, alias entries containing path traversal segments (for example '../../escaped-link') are used when creating dependency and package links, bin destinations, hoisted entries, and virtual-store slots, allowing symlinks and directories to be created outside the intended project and node_modules boundary. Version 12.0.0-alpha.5 validates dependency names and every virtual-store slot path with a shared safe-join containment helper before any filesystem materialization, rejecting traversal, absolute, platform-specific, and reserved names with ERR_PNPM_INVALID_DEPENDENCY_NAME.

Analysis

Technical impact

pacquet, the Rust component of pnpm, fails to validate dependency alias paths from a lockfile before using them in filesystem operations during installation. This oversight permits attackers to embed path traversal sequences (for example, "../../escaped-link") within alias entries. When pnpm processes an attacker‑supplied lockfile with the --trust-lockfile or frozen options, it will create symlinks, directories, or links outside the intended project and node_modules boundaries. The result is arbitrary creation and manipulation of files or directories on the local filesystem, potentially overwriting critical data or enabling subsequent exploitation steps.

Affected Systems

The issue affects pnpm versions 12.0.0-alpha.0 through 12.0.0-alpha.4. Versions 12.0.0-alpha.5 and newer contain validation that rejects traversal, absolute, platform‑specific, or reserved names and protects the virtual‑store from unsafe entries.

Risk and Exploitability

The vulnerability scores a CVSS base score of 7.1, indicating medium to high severity. EPSS score is not available; the vulnerability is not listed in CISA KEV. The primary attack vector is a local attacker who can supply or influence the lockfile content. If the lockfile is not trusted, the exploitation can lead to filesystem modifications outside the project directory. Successful exploitation may lead to privilege escalation or compromise of the system file hierarchy, contingent on user privileges during pnpm execution.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

pnpm

unaffected

Version	Status	Constraints
`12.0.0-alpha.0`	affected	< 12.0.0-alpha.5
`12.0.0-alpha.5`	unaffected	—

No data.

Vendor Product Versions

Pnpm

Version	Status	Scheme	Platform
`[12.0.0-alpha.0,12.0.0-alpha.5)`	affected	semver	—
`12.0.0-alpha.5`	unaffected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade pnpm to 12.0.0-alpha.5 or later to benefit from validated dependency names and safe‑join containment.
If an upgrade cannot be performed immediately, avoid using the --trust‑lockfile or frozen lockfile options when installing packages from untrusted sources.
Verify that lockfiles are sourced from reputable origins and inspect alias values for suspicious path traversal before permitting installation.

Generated by OpenCVE AI on September 27, 2026 at 18:25 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Passive

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.259% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/pnpm/pnpm/security/advisories/GHSA-2rx9-3g3h-c2jv
https://nvd.nist.gov/vuln/detail/CVE-2026-101044
https://www.cve.org/CVERecord?id=CVE-2026-101044
https://www.vulncheck.com/advisories/pacquet-before-12.0.0-alpha.5-path-traversal-via-lockfile-alias

History

Sep 30, 2026 5:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 28, 2026 12:15 AM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-101044 https://www.cve.org/CVERecord?id=CVE-2026-101044
Metrics	threat_severity `None`	threat_severity `Important`

Sep 27, 2026 5:30 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		pacquet, the Rust package-manager component shipped in the pnpm npm package versions >=12.0.0-alpha.0 and <12.0.0-alpha.5, does not validate dependency alias/name paths taken from a lockfile before using them in install-time filesystem joins. When a user installs a project with an attacker-supplied lockfile using --trust-lockfile or a frozen lockfile, alias entries containing path traversal segments (for example '../../escaped-link') are used when creating dependency and package links, bin destinations, hoisted entries, and virtual-store slots, allowing symlinks and directories to be created outside the intended project and node_modules boundary. Version 12.0.0-alpha.5 validates dependency names and every virtual-store slot path with a shared safe-join containment helper before any filesystem materialization, rejecting traversal, absolute, platform-specific, and reserved names with ERR_PNPM_INVALID_DEPENDENCY_NAME.
Title		pacquet before 12.0.0-alpha.5 Path Traversal via lockfile alias
First Time appeared		Pnpm Pnpm pnpm
Weaknesses		CWE-22
CPEs		cpe:2.3:a:pnpm:pnpm::::::::
Vendors & Products		Pnpm Pnpm pnpm
References		https://github.com/pnpm/pnpm/security/advisories/GHSA-2rx9-3g3h-c2jv https://www.vulncheck.com/advisories/pacquet-before-12.0.0-alpha.5-path-traversal-via-lockfile-alias
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L'}` cvssV4_0 `{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N'}`