EUVD-2026-87975
GHSA-qj85-gv7w-fqmr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft lockfile with traversal alias key
-
DeliveryVictim installs project with --trust-lockfile
-
ExploitAlias path used in install-time filesystem join
-
ExecutionSymlink/directory created outside node_modules boundary
-
ImpactFiles written/linked outside project (integrity impact)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an attacker-supplied lockfile AND the victim explicitly running pacquet install with --trust-lockfile or a frozen lockfile - the trust flag deliberately bypasses re-resolution, so it is the enabling condition. Only pnpm npm-package versions 12.0.0-alpha.0 through 12.0.0-alpha.4 that ship the Rust pacquet component are affected; the TypeScript pnpm CLI, the lockfile format, and stable pnpm releases are NOT affected. Limiting factors: mandatory user interaction (UI:P), reliance on the user opting into trust-lockfile/frozen-install mode, and the extremely narrow alpha-only version window. |
| Impact | This is a genuine but conditional supply-chain integrity risk, not a widely-exploitable network vulnerability. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L) scores 7.1 (High) with integrity as the dominant impact (VI:H) and no confidentiality impact (VC:N), which is consistent with a path-traversal flaw that creates symlinks/directories outside the node_modules boundary rather than leaking data. UI:P is the key limiter: exploitation is not autonomous - a victim must actively install an attacker-supplied lockfile using --trust-lockfile or a frozen lockfile. No EPSS score, no CISA KEV listing, and no standalone public exploit were provided; the GHSA advisory describes an internal 'exploit replay' ( |
| Exploit ScenarioDerived | An attacker publishes or contributes a project (e.g. a repo or package) containing a crafted pnpm lockfile whose dependency alias keys embed traversal segments like '../../escaped-link'. A developer clones it and runs a pacquet install with --trust-lockfile or --frozen-lockfile on an affected pnpm 12.0.0-alpha build; during link/bin/hoist/virtual-store materialization the alias path is joined without containment, creating symlinks or directories outside the intended project. No public exploit code was identified, though the advisory documents a working reproduction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 27, 2026
Path traversal in the Rust-based pacquet package-manager component shipped inside pnpm allows a crafted lockfile to create symlinks and directories outside the project or node_modules boundary during installation. Only pnpm npm-package versions 12.0.0-alpha.0 through 12.0.0-alpha.4 that bundle pacquet are affected, and exploitation requires the victim to explicitly run an install with --trust-lockfile or a frozen lockfile against an attacker-supplied lockfile, so the trust flag that bypasses re-resolution is the enabling condition rather than a remotely reachable flaw. Impact is integrity-focused (CVSS 7.1, CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L), and no public exploit code was identified at time of analysis.
RemediationAI
Upgrade pnpm to 12.0.0-alpha.5 or later, which is the vendor-released patch that adds the shared safe-join containment check before any symlink, bin, hoist, or virtual-store directory is created (see https://github.com/pnpm/pnpm/security/advisories/GHSA-2rx9-3g3h-c2jv and the fixes in PR https://github.com/pnpm/pnpm/pull/12872 and commit 51300fd41c5e4c8f47635108e373cc3d1f324fa7). If upgrading immediately is not possible, stop invoking pacquet with --trust-lockfile or frozen-lockfile against lockfiles you did not generate yourself, since disabling that trust bypass forces re-resolution and prevents the malicious alias from reaching the filesystem joins; treat lockfiles as untrusted input and inspect dependency alias keys for path separators or '..' segments before installation. Because the flaw is isolated to the Rust pacquet alpha component, staying on the stable TypeScript pnpm CLI or any stable pnpm release removes the exposure entirely with no functional loss. Note that these mitigations are compensating controls with real trade-offs: avoiding trust-lockfile weakens reproducible/CI install guarantees and adds resolution overhead, while manual lockfile review is error-prone at scale, so patching remains the only complete fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a classic CWE-22 path traversal rooted in the install-time filesystem join logic of pacquet, the Rust re-implementation of the pnpm package manager. Dependency alias and name keys taken from a lockfile were passed into filesystem path joins without containment checks, so alias entries such as '../../escaped-link' escaped the intended project or node_modules root when pacquet materialized dependency links, transitive package links, bin destinations, public/private hoist entries, and virtual-store slots. Because --trust-lockfile and frozen-lockfile installs intentionally skip re-resolution, the malicious alias survived straight into the install phase, and the warm-install fast path plus global virtual-store slot paths (including version-derived components) widened the attack surface further. The fix introduces a shared safe-join containment helper (pacquet/crates/package-manager/src/safe_join_modules_dir.rs) that validates dependency names and every virtual-store slot path before any filesystem materialization, rejecting traversal, absolute, platform-specific, and reserved names with ERR_PNPM_INVALID_DEPENDENCY_NAME; valid scoped and unscoped aliases continue to work, and neither the TypeScript CLI nor the lockfile format was changed because the escape was specific to pacquet.
Know when Rust gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Lockfile is attacker-supplied over the network (AV:N) but the victim must run a trust/frozen install (UI:R); no auth (PR:N); arbitrary out-of-tree symlink/file creation gives I:H, minor A:L, no data disclosure (C:N).
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
pacquet, the Rust package-manager component shipped in the pnpm npm package versions >=12.0.0-alpha.0 and <12.0.0-alpha.5, does not validate dependency alias/name paths taken from a lockfile before using them in install-time filesystem joins. When a user installs a project with an attacker-supplied lockfile using --trust-lockfile or a frozen lockfile, alias entries containing path traversal segments (for example '../../escaped-link') are used when creating dependency and package links, bin destinations, hoisted entries, and virtual-store slots, allowing symlinks and directories to be created outside the intended project and node_modules boundary. Version 12.0.0-alpha.5 validates dependency names and every virtual-store slot path with a shared safe-join containment helper before any filesystem materialization, rejecting traversal, absolute, platform-specific, and reserved names with ERR_PNPM_INVALID_DEPENDENCY_NAME.
Articles & Coverage 1
Technical POC Analysis
CWE-22 (path traversal) in pacquet, the Rust package-manager component shipped inside the pnpm npm package.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
The Rust-based pacquet component bundled in pnpm npm-package versions 12.0.0-alpha.0 through 12.0.0-alpha.4 has a high-severity path traversal issue that can let a malicious lockfile create symlinks and directories outside the intended project or node_modules boundary during installation. The issue is unauthenticated per the CVSS vector but requires user interaction, specifically an install with --trust-lockfile or a frozen lockfile against an attacker-supplied lockfile, so engineering teams and CI/CD pipelines that consume untrusted lockfiles are the primary exposure. Leadership should care because successful exploitation can compromise build integrity and write files outside project boundaries, though no public exploit identified at time of analysis and no vendor-released patch identified at time of analysis.
No vendor-released patch identified at time of analysis. Interim mitigations include removing or blocking pnpm npm-package versions 12.0.0-alpha.0 through 12.0.0-alpha.4 that bundle pacquet; prohibiting --trust-lockfile and frozen-lockfile installs with untrusted lockfiles; requiring lockfiles only from trusted repositories and validating them before use; running installs in least-privilege, isolated environments; and monitoring the vendor advisory for a patched release.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Command injection via Windows CreateProcess argument parsing affects multiple language runtimes and tooling (Node.js, PH
In the standard library in Rust before 1.52.0, a double free can occur in the Vec::from_iter function if freeing the ele
In the standard library in Rust before 1.52.0, the Zip implementation can report an incorrect size due to an integer ove
Stored cross-site scripting and open redirect in Warpgate's SSO endpoints (versions prior to 0.25.5) allow an unauthenti
library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginni
Denial of service in the Vector observability pipeline's `logstash` source (versions 0.15.0 through 0.56.x) allows a rem
The Rust Programming Language Standard Library 1.34.x before 1.34.2 contains a stabilized method which, if overridden, c
In the standard library in Rust before 1.52.0, the Zip implementation calls __iterator_get_unchecked() more than once fo
In the standard library in Rust before 1.50.0, read_to_end() does not validate the return value from Read in an unsafe c
Cargo prior to Rust 1.26.0 may download the wrong dependency if your package.toml file uses the `package` configuration
Rust is a programming language. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no auth
The Rust Programming Language Standard Library version 1.29.0, 1.28.0, 1.27.2, 1.27.1, 127.0, 126.2, 126.1, 126.0 contai
Exploit-DB