{"schema":"threatline.record/2","record":{"id":"CVE-2026-101044","aliases":["GHSA-2rx9-3g3h-c2jv"],"summary":"pacquet before 12.0.0-alpha.5 Path Traversal via lockfile alias","details":"pacquet, the Rust package-manager component shipped in the pnpm npm package versions >=12.0.0-alpha.0 and <12.0.0-alpha.5, does not validate dependency alias/name paths taken from a lockfile before using them in install-time filesystem joins. When a user installs a project with an attacker-supplied lockfile using --trust-lockfile or a frozen lockfile, alias entries containing path traversal segments (for example '../../escaped-link') are used when creating dependency and package links, bin destinations, hoisted entries, and virtual-store slots, allowing symlinks and directories to be created outside the intended project and node_modules boundary. Version 12.0.0-alpha.5 validates dependency names and every virtual-store slot path with a shared safe-join containment helper before any filesystem materialization, rejecting traversal, absolute, platform-specific, and reserved names with ERR_PNPM_INVALID_DEPENDENCY_NAME.","categories":["Libraries & packages"],"product":"pnpm","vendor":"pnpm","ecosystem":"npm","affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101044","source_modified_at":"2026-09-30T15:29:02.862Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"pnpm","vendor":"pnpm","versions":[{"version":"12.0.0-alpha.0","status":"affected","versionType":"semver","lessThan":"12.0.0-alpha.5"},{"version":"12.0.0-alpha.5","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-2rx9-3g3h-c2jv","source_modified_at":"2026-09-01T19:15:13.484466358Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"pnpm","ecosystem":"npm","purl":"pkg:npm/pnpm"},"ranges":[{"type":"SEMVER","events":[{"introduced":"12.0.0-alpha.0"},{"fixed":"12.0.0-alpha.5"}]}],"versions":[]}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101044","source_modified_at":"2026-09-30T15:29:02.862Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"pnpm","ecosystem":null},"version":"12.0.0-alpha.5","basis":"first unaffected version stated in the CVE record"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-2rx9-3g3h-c2jv","source_modified_at":"2026-09-01T19:15:13.484466358Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"pnpm","ecosystem":"npm","purl":"pkg:npm/pnpm"},"version":"12.0.0-alpha.5"}],"cvss":7.1,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00259,"percentile":0.16608,"score_date":"2026-10-23"},"published_at":"2026-09-27T17:02:33.798Z","modified_at":"2026-09-30T15:29:02.862Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-101044","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-09-30T15:29:02.862Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-2rx9-3g3h-c2jv","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-09-01T19:15:13.484466358Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101044","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","OSV","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/pnpm/pnpm/security/advisories/GHSA-2rx9-3g3h-c2jv","tags":["vendor-advisory"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/pacquet-before-12.0.0-alpha.5-path-traversal-via-lockfile-alias","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-09-30T15:28:48.886529Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-09-30T15:29:02.862Z","content_hash":"1a0cfd27bf6351976f5d8eeec8ebd09c39b629a410c25a70461e0b0db330d6eb"}}