CVE-2026-59196

[CVE catalog]

Severity

High · CVSS 7.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

Published

Jul 6, 2026, 3:18:53 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.40% · Oct 25, 2026

A flaw was found in pnpm, a package manager. This vulnerability allows a remote attacker to manipulate the package installation process by using a specially crafted lockfile alias. This could lead to path traversal, enabling the attacker to write files outside the designated installation directory or overwrite system files, potentially compromising the integrity of the system. pnpm: pnpm: hoisted install imports lockfile alias outside node_modules This Important vulnerability in pnpm, a package manager, allows a remote attacker to achieve arbitrary file write by manipulating the package installation process with a specially crafted lockfile alias. This could lead to path traversal, enabling the attacker to write files outside the designated installation directory or overwrite system files, potentially compromising the integrity of the system where pnpm is utilized for package management. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.