pnpm version 9 contains a path traversal vulnerability in handling the 'directories.bin' field of package manifests. This flaw allows a malicious npm package to specify a relative path that escapes the package root directory, causing pnpm to change file permissions (chmod 755) on arbitrary files outside the package directory on Unix-like systems. Windows is not affected. The vulnerability arises because the path is joined without validation to ensure it remains within the package directory.