6.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-24056

CVE-2026-24056: pnpm has symlink traversal in file:/git dependencies

pnpm is a package manager. Prior to version 10.28.2, when pnpm installs a file: (directory) or git: dependency, it follows symlinks and reads their target contents without constraining them to the package root. A malicious package containing a symlink to an absolute path (e.g., /etc/passwd, ~/.ssh/id_rsa) causes pnpm to copy that file's contents into node_modules, leaking local data. The vulnerability only affects file: and git: dependencies. Registry packages (npm) have symlinks stripped during publish and are NOT affected. The issue impacts developers installing local/file dependencies andCI/CD pipelines installing git dependencies. It can lead to credential theft via symlinks to ~/.aws/credentials, ~/.npmrc, ~/.ssh/id_rsa. Version 10.28.2 contains a patch.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-24056

CVE-2026-24056:

6.7

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pnpm	npm	< 10.28.2	10.28.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a path traversal issue in pnpm, occurring when installing packages from file: or git: sources. The root cause is the insecure handling of symbolic links within the package being installed. The code in store/cafs/src/addFilesFromDir.ts used fs.statSync() and fs.readFileSync(), both of which follow symlinks by default. A malicious package could contain a symlink pointing to a sensitive file on the developer's machine (e.g., /etc/passwd, ~/.ssh/id_rsa). When pnpm installs this package, the addFilesFromDir and its helper function findFiles would follow the symlink and copy the contents of the target file into the project's node_modules directory, thus leaking local data.

The patch addresses this by replacing fs.statSync with fs.lstatSync to detect symlinks without following them. It then explicitly resolves the symlink's target path using fs.realpathSync and validates that this path is within the package's root directory using the is-subdir library. If the symlink points outside the package, it is skipped. The primary vulnerable functions are addFilesFromDir and findFiles, as they were responsible for the file traversal that followed these malicious symlinks.

Vulnerable functions

addFilesFromDir

store/cafs/src/addFilesFromDir.ts

This is the main entry point function that processes files from a given directory. The original implementation directly used `fs.statSync` on file paths, which follows symbolic links. This allowed a malicious package with a symlink pointing outside the package directory to cause the function to read and store files from arbitrary locations on the filesystem.

findFilesInDir

store/cafs/src/addFilesFromDir.ts

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.