Listen to this Post
The vulnerability arises from how pacquet, a Rust-based package manager, handles dependency aliases within lockfiles. When a project is installed using `–trust-lockfile` or a frozen lockfile (--frozen-lockfile), pacquet traditionally accepted the lockfile’s content as authoritative and proceeded with installation. A malicious or compromised lockfile could define a dependency alias containing path traversal sequences, such as ../../escaped-link. During the installation process, this crafted alias could be joined directly with filesystem paths, allowing symlinks or directories to be created outside the intended project or `node_modules` boundary. This path traversal flaw, tracked as GHSA-fr4h-3cph-29xv / CAND-PNPM-059, affects the hoisted dependency resolution process.
The fix introduces a shared containment rule via a new `safe_join_modules_dir` helper (in both TypeScript and Rust). This helper is now invoked at every critical filesystem sink before any materialization occurs. These sinks include virtual-store slots, direct and transitive dependency links, package links, bin destinations, and public/private hoist destinations. The validation logic rejects dependency names that contain traversal sequences (../), are absolute paths, are platform-specific, or are reserved names like `.bin` or .pnpm.
Crucially, the validation is performed not only during the main installation path but also before the current-lockfile fast path (the “warm-install bypass”) and before store initialization. This prevents a poisoned prior-install slot from circumventing the new checks. If a name fails validation, the operation is aborted and the error `ERR_PNPM_INVALID_DEPENDENCY_NAME` is returned. The patch ensures that even with --trust-lockfile, a crafted alias cannot escape the project directory.
DailyCVE Form:
Platform: pacquet
Version: before patch
Vulnerability: Path Traversal
Severity: Medium (7.1)
Date: 2026-06-27
Prediction: Patch available
What Undercode Say:
The fix introduces strict validation across all filesystem operations. The following commands were used to validate the patch:
$ cargo test --locked -p pacquet-package-manager --lib PASS: 434 tests $ cargo clippy --locked -p pacquet-package-manager --all-targets -- --deny warnings PASS $ cargo fmt --all -- --check PASS
The primary change is in pacquet/crates/package-manager/src/safe_join_modules_dir.rs, which defines the shared containment rule. The `tests.rs` files now cover all sinks, including warm installs and global virtual-store slots.
Exploit: (Educational Purposes!)
A malicious actor could craft a `pnpm-lock.yaml` file with a dependency alias designed to escape the installation root. For example, an alias like `”../../escaped-link”: “…”` could be used. When a developer or CI system runs `pacquet install –frozen-lockfile –trust-lockfile` using this malicious lockfile, the package manager would, prior to the patch, create a symlink or directory outside the project boundary, potentially overwriting critical system files or other projects.
Protection: from this CVE
To protect against this vulnerability:
- Upgrade: Update to the patched versions of pnpm (10.34.4 or 11.7.0+) or ensure your pacquet build includes the fix.
- Avoid Trusting Lockfiles: Do not use `–trust-lockfile` with lockfiles from untrusted sources.
- Review Lockfiles: In CI/CD pipelines, consider adding a step to validate lockfile contents before installation, although the patch makes this less critical.
Impact:
Successful exploitation allows a remote attacker to write files outside the intended project directory. This could lead to:
– Arbitrary File Overwrite: Overwriting critical files in the system or other projects.
– Code Execution: In some scenarios, overwriting executable files or configuration could lead to code execution.
– Directory Hijacking: Overwriting pnpm-owned directories like `.pnpm` or .bin, potentially breaking the package manager’s internal state.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
