pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install (CVE-2026-82393)

pnpm, a package manager, suffers from a path traversal vulnerability in its handling of tarball dependency manifests prior to versions 10.34.5 and 11.11.0. The vulnerability occurs because the package.json manifest's name field in a tarball dependency can contain scoped path traversal sequences that are not properly sanitized. The code in pnpm11/resolving/npm-resolver/src/pickPackage.ts only rejects slash characters for unscoped names, allowing scoped names to bypass this check. During the installation process, the unvalidated name is used in raw path joins in multiple internal modules, causing extraction of files outside the node_modules directory. This allows an attacker to overwrite arbitrary files on the filesystem even when the --ignore-scripts flag is used. Overwritten files can include shell startup files, Git hooks, or package code, potentially leading to code execution. The vulnerability is tracked as CVE-2026-82393 and has a CVSS 3.1 score of 7.5 (high severity). Fixes are available in pnpm versions 10.34.5 and 11.11.0.

Successful exploitation allows an attacker to write or overwrite arbitrary files on the victim's filesystem during package installation. This can lead to replacement of critical files such as shell startup scripts, Git hooks, or installed package code, which may result in arbitrary code execution. The vulnerability can be triggered even when the --ignore-scripts flag is used, increasing the risk of exploitation. The CVSS score of 7.5 reflects high impact on confidentiality, integrity, and availability.

A fix is available and users should upgrade pnpm to version 10.34.5 or later, or 11.11.0 or later. Applying these official patches will prevent the path traversal vulnerability. Until upgraded, users should be cautious when installing packages from untrusted sources. No additional vendor advisory states that no action is required or that the issue is already mitigated.