pnpm has symlink traversal in file:/git dependencies (CVE-2026-24056)

pnpm, a package manager, has a vulnerability (CVE-2026-24056) in versions before 10.28.2 where it improperly follows symlinks in file: and git: dependencies during installation. This behavior allows a malicious package to create symlinks to arbitrary absolute paths on the local filesystem, causing pnpm to copy sensitive files such as /etc/passwd or private SSH keys into the node_modules directory. This vulnerability does not affect registry packages because symlinks are stripped during publishing. The vulnerability impacts developers using local or git dependencies and CI/CD pipelines installing git dependencies. The issue is fixed in pnpm version 10.28.2.

Exploitation of this vulnerability can lead to local data leakage by copying sensitive files from the host system into the node_modules directory, potentially exposing credentials such as AWS credentials, npm configuration, and SSH private keys. This compromises the confidentiality of sensitive local files for users installing malicious file: or git: dependencies with vulnerable pnpm versions.

Upgrade pnpm to version 10.28.2 or later, where the vulnerability is patched. Avoid using untrusted file: or git: dependencies until the upgrade is applied. No additional mitigations are indicated by the vendor advisory.