pnpm: stage download writes outside destination via manifest version traversal (CVE-2026-55700)

pnpm is a package manager that, in versions from 11.3.0 until 11.5.3, derived a local filename for the 'pnpm stage download' command from registry-controlled package name and version fields without sufficient validation. A maliciously crafted manifest could exploit this to escape the designated download directory and overwrite other files on the filesystem. The fix introduced in version 11.5.3 validates both the package name and version fields, derives a safe filename, and verifies the final destination path before writing to prevent directory traversal.

An attacker able to supply a crafted package manifest can cause pnpm to write files outside the intended directory, potentially overwriting arbitrary files. This can lead to integrity issues and local denial of service. The CVSS score is 7.1 (high severity), reflecting that exploitation requires no privileges but user interaction and results in integrity impact and low availability impact.

Upgrade pnpm to version 11.5.3 or later, where the vulnerability is fixed. The fix includes validation of package name and version fields and safe filename derivation to prevent directory traversal. No other mitigations are specified or required.