Security readout for executives and security teams
Plain-English summary
CVE-2026-24056 lets a malicious local or git dependency cause pnpm to copy sensitive local files into node_modules by abusing symlinks. The main business risk is credential exposure on developer machines or CI/CD runners. Public sources say npm registry packages are not affected. Upgrade pnpm to 10.28.2 or later.
Executive priority
Prioritize remediation for engineering and CI/CD environments that handle secrets. The issue is moderate severity but can expose high-value credentials if malicious dependencies are installed. Registry-only npm workflows appear lower risk based on the advisory.
Technical view
pnpm before 10.28.2 follows symlinks while installing file: directory and git: dependencies without constraining targets to the package root. This can disclose local file contents into node_modules. The issue is mapped to CWE-22 and CWE-59, with CVSS 4.0 score 6.7. A patch is referenced in pnpm 10.28.2.
Likely exposure
Exposure is most likely where developers or CI/CD pipelines install untrusted, forked, or third-party git dependencies, or local file: dependencies. Standard npm registry packages are stated as not affected because symlinks are stripped during publishing.
Exploitation context
The CVE is not listed as KEV in the provided data, and no source provided here states active exploitation. Exploitation requires a user or automation to install a malicious file: or git: dependency with pnpm before 10.28.2.
Researcher notes
Evidence points to a symlink traversal/data disclosure flaw limited to pnpm file: and git: dependency installation. Do not generalize to registry packages. The provided sources identify the fixed version and patch commit, but do not provide evidence of exploitation in the wild.
Mitigation direction
- Upgrade pnpm to version 10.28.2 or later.
- Avoid installing untrusted file: or git: dependencies in development and CI/CD workflows.
- Review CI/CD jobs that install dependencies from git repositories or local paths.
- Check pnpm advisory and release notes for any additional vendor guidance.
Validation and detection
- Inventory pnpm versions used by developers, build agents, and CI/CD containers.
- Identify projects using file: or git: dependencies with pnpm.
- Review dependency sources for untrusted or unexpected repositories and local paths.
- Confirm upgraded environments report pnpm 10.28.2 or later.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-22: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-59: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-24056 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.7 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
6.7MediumVector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/pnpm/pnpm/security/advisories/GHSA-m733-5w8f-5ggwCVE reference · x_refsource_CONFIRM
- https://github.com/pnpm/pnpm/commit/b277b45bc35ae77ca72d7634d144bbd58a48b70fCVE reference · x_refsource_MISC
- https://github.com/pnpm/pnpm/releases/tag/v10.28.2CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Improper Link Resolution Before File Access ('Link Following')
Improper Link Resolution Before File Access ('Link Following') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.