Path Traversal Vulnerability in pnpm Package Manager

CVE-2026-82393

What is CVE-2026-82393?

The pnpm package manager, prior to versions 10.34.5 and 11.11.0, is susceptible to a path traversal vulnerability that occurs when handling tarball dependencies. The flaw arises from the improper validation of a scoped path traversal in the package.json manifest name. Specifically, pnpm fails to reject slash characters for unscoped names, allowing an attacker to exploit this weakness. As a result, during the installation process, unvalidated package names can lead to raw path joins, enabling package extraction outside the expected node_modules directory. This can permit maliciously controlled files to overwrite arbitrary filesystem paths, even when the --ignore-scripts option is enabled. The ramifications of this vulnerability are significant, as the overwrite of essential files (like shell startup scripts, Git hooks, or installed package code) can potentially lead to unauthorized code execution. Users are urged to upgrade to the latest versions to safeguard against this issue.

References