What is the CVSS score of EUVD-2026-41882?

EUVD-2026-41882 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L. EPSS exploitation probability: 0.3%.

Which versions of Pnpm are affected by EUVD-2026-41882?

pnpm package manager versions contain a critical path traversal vulnerability allowing malicious lockfiles to write arbitrary files outside the intended directory, compromising build environment…. A patch is available.

How to fix or mitigate EUVD-2026-41882?

24 hours: Inventory all systems running pnpm, document versions deployed, and assess scope of affected projects and build pipelines. 7 days: Implement mandatory code review for all pnpm-lock.yaml modifications, deploy Software Composition Analysis (SCA) tooling to detect lockfile anomalies, and enable comprehensive audit logging on pnpm install operations. 30 days: Monitor pnpm releases for patched versions (10.34.4 and 11.7.0 or later indicated in advisory); conduct testing in isolated environment and establish coordinated upgrade plan.

Pnpm EUVD-2026-41882

| CVE-2026-59196 HIGH

Path Traversal (CWE-22)

2026-07-06 security-advisories@github.com

Path Traversal Red Hat Pnpm

7.1

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

Red Hat

7.1 HIGH

qualitative

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Patch available

Jul 06, 2026 - 17:01 EUVD

Analysis Generated

Jul 06, 2026 - 16:46 vuln.today

DescriptionCVE.org

pnpm is a package manager. Prior to 10.34.4 and 11.7.0, a crafted lockfile alias could be joined directly under a hoisted node_modules directory. Traversal aliases could escape that directory, while reserved aliases such as .bin or .pnpm could overwrite pnpm-owned layout. This vulnerability is fixed in 10.34.4 and 11.7.0.

AnalysisAI

Arbitrary file write via path traversal in pnpm prior to 10.34.4 and 11.7.0 lets a crafted lockfile place or overwrite files outside the intended hoisted node_modules directory when a victim installs dependencies. A malicious pnpm-lock.yaml can supply an alias containing traversal sequences (e.g. ../) to escape the module directory, or use reserved aliases like .bin or .pnpm to clobber pnpm-owned layout, enabling integrity compromise of the install tree. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw is remotely deliverable through shared repositories or packages and requires only that a user run an install.