CVE-2026-59195

[CVE catalog]

Severity

High · CVSS 8.2CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:L

Published

Jul 6, 2026, 3:21:03 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.40% · Oct 25, 2026

A flaw was found in pnpm, a package manager. A remote attacker could exploit a path traversal vulnerability by crafting a malicious `pnpm-lock.yaml` file. When a user installs dependencies from such a repository, pnpm incorrectly processes package names from the `configDependencies` section, leading to the creation of symbolic links outside the intended directory. This allows an attacker to achieve arbitrary file writes within the victim's project directory, potentially extending to other areas of the filesystem. pnpm: pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config This is an Important path traversal vulnerability in pnpm, a package manager used by Red Hat products such as Red Hat Build of Keycloak, Enterprise Application Platform, Red Hat AMQ, and Konflux. A malicious repository containing a specially crafted `pnpm-lock.yaml` file can lead to the creation of arbitrary symlinks outside the intended `node_modules/.pnpm-config` directory during `pnpm install`. This provides an attacker with a filesystem write primitive, even when `--ignore-scripts` is used, increasing the risk of unauthorized file manipulation. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.