{"vulnerability": "GHSA-fr4h-3cph-29xv", "sightings": [{"uuid": "a8b11d55-8c45-40ca-979c-7a69c2287ef4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-fr4h-3cph-29xv", "type": "seen", "source": "https://gist.github.com/alon710/cd2ea8f2476653fb40753d5cd0d6d64b", "content": "# GHSA-FR4H-3CPH-29XV: GHSA-FR4H-3CPH-29XV: Path Traversal and Directory Hijacking in pnpm and pacquet Dependency Resolution\n\n> **CVSS Score:** 7.1\n> **Published:** 2026-06-27\n> **Full Report:** https://cvereports.com/reports/GHSA-FR4H-3CPH-29XV\n\n## Summary\nGHSA-FR4H-3CPH-29XV is a high-severity path traversal vulnerability in pnpm and its Rust-based port pacquet. The flaw manifests when using the hoisted node-linker configuration, allowing an attacker to manipulate the lockfile to resolve relative traversal sequences or target reserved subdirectories, leading to arbitrary file write or execution hijacking.\n\n## TL;DR\nA path traversal vulnerability in pnpm and pacquet under 'hoisted' mode allows attackers to overwrite files outside the installation directory or hijack binaries inside the virtual store via malicious lockfiles.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-22, CWE-73\n- **Attack Vector**: Network / Remote\n- **CVSS Score**: 7.1\n- **Exploit Status**: Proof-of-Concept\n- **Impact**: Arbitrary File Write / Code Execution\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- pnpm CLI\n- pacquet Rust port\n- **pnpm**: < 10.34.4 (Fixed in: `10.34.4`)\n- **pnpm**: >= 11.0.0, < 11.7.0 (Fixed in: `11.7.0`)\n\n## Mitigation\n\n- Upgrade pnpm to 10.34.4 (for v10) or 11.7.0+ (for v11)\n- Avoid the 'hoisted' nodeLinker topology in configuration\n- Enforce --frozen-lockfile in continuous integration pipelines\n- Implement static analysis on lockfiles to detect traversal elements\n\n**Remediation Steps:**\n1. Verify the current global pnpm version using 'pnpm -v'.\n2. Execute 'npm install -g pnpm@latest' or 'corepack prepare pnpm@latest --activate' to update.\n3. Audit local config files (.npmrc) and ensure 'nodeLinker: hoisted' is avoided if updates are delayed.\n4. Implement a build gate to detect relative paths in pnpm-lock.yaml files.\n\n## References\n\n- [Official GitHub Advisory](https://github.com/advisories/GHSA-fr4h-3cph-29xv)\n- [pnpm Security Advisory](https://github.com/pnpm/pnpm/security/advisories/GHSA-fr4h-3cph-29xv)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-FR4H-3CPH-29XV) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-06-27T04:42:28.746856Z"}]}