CVE-2026-59195

pnpm is a package manager. Prior to 10.34.4 and 11.8.0, pnpm accepts package names from the env lockfile configDependencies section and uses those names directly when creating config dependency symlinks under node_modules/.pnpm-config. A malicious repository can commit a crafted pnpm-lock.yaml whose env-lockfile document contains a traversal-shaped config dependency name. During pnpm install, pnpm installs the config dependency and creates a symlink at a path derived from that name. This vulnerability is fixed in 10.34.4 and 11.8.0.

• CWE-22

• https://github.com/pnpm/pnpm/security/advisories/GHSA-qrv3-253h-g69cExploit, Mitigation, Vendor Advisory
• https://github.com/pnpm/pnpm/security/advisories/GHSA-qrv3-253h-g69cExploit, Mitigation, Vendor Advisory

Published

Jul 6, 2026

Last Modified

Jul 7, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-5918Inappropriate implementation in Navigation in Google Chrome …4.3
• CVE-2026-59180Apprise is an open source library which allows you to send a…3.1
• CVE-2026-5919Insufficient validation of untrusted input in WebSockets in …6.5
• CVE-2026-59190grav-plugin-admin is an HTML user interface that provides a …8.7
• CVE-2026-59193Grav is a file-based Web platform. Prior to 2.0.0, an authen…4.9
• CVE-2026-59194pnpm is a package manager. Prior to 10.34.4 and 11.7.0, a cr…7.1
• CVE-2026-59196pnpm is a package manager. Prior to 10.34.4 and 11.7.0, a cr…7.1
• CVE-2026-59197Pillow is a Python imaging library. Prior to 12.3.0, Pillow'…8.2
• CVE-2026-59198Pillow is a Python imaging library. From 5.2.0 until 12.3.0,…7.5
• CVE-2026-59199Pillow is a Python imaging library. Prior to 12.3.0, Pillow …7.5
• CVE-2026-59200Pillow is a Python imaging library. From 5.1.0 until 12.3.0,…7.5
• CVE-2026-59203Pillow is a Python imaging library. From 12.0.0 through 12.2…7.5