pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-94.
Summary
pnpm is a package manager. Prior to 10.34.5 and 11.11.0, pnpm accepts a scoped path traversal in a tarball dependency's package.json manifest name because pnpm11/resolving/npm-resolver/src/pickPackage.ts rejects slash characters only for unscoped names. During pnpm install, the unvalidated name reaches raw path joins in pnpm11/installing/deps-resolver/src/resolvePeers.ts, pnpm11/installing/deps-resolver/src/index.ts, and pnpm11/deps/graph-builder/src/lockfileToDepGraph.ts, causing package extraction outside node_modules and allowing attacker-controlled files to overwrite arbitrary filesystem paths even when --ignore-scripts is used. The overwrite can replace shell startup files, Git hooks, or installed package code and lead to code execution. This issue is fixed in versions 10.34.5, and 11.11.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| pnpm | pnpm | before 10.34.5; 11.0.0 to before 11.11.0 | 10.34.5, 11.11.0 | Patch available | CNA |
| — | pnpm (npm) | before 10.34.5 | 10.34.5 | Patch available | GHSA-vq4v-j7r6-jq4m |
| — | pnpm (npm) | 11.0.0 to before 11.11.0 | 11.11.0 | Patch available | GHSA-vq4v-j7r6-jq4m |
- pnpm Vendorpnpm Affected before 10.34.5; 11.0.0 to before 11.11.0 Fixed in 10.34.5, 11.11.0 Patch available CNA
- pnpm (npm) Vendor— Affected before 10.34.5 Fixed in 10.34.5 Patch available GHSA-vq4v-j7r6-jq4m
- pnpm (npm) Vendor— Affected 11.0.0 to before 11.11.0 Fixed in 11.11.0 Patch available GHSA-vq4v-j7r6-jq4m
Remediation
- Fix · CNA pnpm (pnpm) Fixed in 10.34.5, 11.11.0
- Fix · GHSA-vq4v-j7r6-jq4m pnpm (npm) Fixed in 10.34.5 Advisory →
- Fix · GHSA-vq4v-j7r6-jq4m pnpm (npm) Fixed in 11.11.0 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
Not affected: 5 products
- Red Hat AMQ Broker 7
- Red Hat Build of Keycloak
- Red Hat Hardened Images
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
Timeline
- 2026-10-02 Threatist record created from CVE-2026-82393
- 2026-10-03 Alias added: GHSA-vq4v-j7r6-jq4m
- 2026-10-31 EPSS moved to the 50th–90th percentile
- 2026-11-03 CISA SSVC decision points changed
References
Other 8
- https://github.com/pnpm/pnpm/security/advisories/GHSA-vq4v-j7r6-jq4m
- https://github.com/pnpm/pnpm/pull/12872
- https://github.com/pnpm/pnpm/pull/12890
- https://github.com/pnpm/pnpm/commit/51300fd41c5e4c8f47635108e373cc3d1f324fa7
- https://github.com/pnpm/pnpm/commit/78e29fe5583a1e5d69ea05e414eff310f78d5ed9
- https://github.com/pnpm/pnpm/releases/tag/v10.34.5
- https://github.com/pnpm/pnpm/releases/tag/v11.11.0
- https://github.com/pnpm/pnpm
More pnpm vulnerabilities
- TI-2025-42715 pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default" CVSS 3.1CRITICAL 9.8
- TI-2023-19086 pnpm incorrectly parses tar archives relative to specification CVSS 3.1CRITICAL 9.8
- TI-2026-40212 pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes CVSS 3.1HIGH 8.8
- TI-2026-40211 pnpm: Repository-controlled configDependencies can select a pacquet native install engine CVSS 3.1HIGH 8.8
- TI-2026-40042 pnpm: manifest identity spoof satisfies allowBuilds and runs attacker lifecycle CVSS 3.1HIGH 8.8
- TI-2026-36842 pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement CVSS 3.1HIGH 8.8
Sources
- CVE-2026-82393 · CVE Program
- CVE-2026-82393 · NVD
- FIRST EPSS
- GHSA-vq4v-j7r6-jq4m · GitHub Advisory Database · CC BY 4.0
- CVE-2026-82393 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences