CVE-2026-82393: pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install
Summary When resolving a package, pnpm uses the resolved manifest name as a raw path segment for the isolated-linker import target. A tarball dependency whose package.json name is a scoped path traversal (@x/../../…/<abs path>) is therefore extracted outside nodemodules, to an attacker-chosen absolute path, and can overwrite existing files there. Attacker controls the destination, filenames, and contents → arbitrary file write → code execution (e.g. ~/.zshrc, .git/hooks/pre-commit, another package's code). Occurs during pnpm install even with --ignore-scripts (no lifecycle scripts run), defeating that safety.
Same class as the just-patched GHSA-hwx4 (transitive-dependency alias traversal) and GHSA-v23m (stage download manifest name/version traversal), in a sink their fixes did not cover: the isolated-linker import target keyed by the resolved name.
Root cause - The isolated-linker import target is built with a raw path.join(modules, <resolved name>) in installing/deps-resolver/src/resolvePeers.ts:706, installing/deps-resolver/src/index.ts:614, and deps/graph-builder/src/lockfileToDepGraph.ts:233 — without the safeJoinModulesDir guard used on the symlink/hoisted/bin paths (installing/deps-restorer/src/lockfileToHoistedDepGraph.ts:222). The store location is nodemodules/.pnpm/<id>/nodemodules/<name>, so a traversal <name> escapes. - The only resolve-time name gate (resolving/npm-resolver/src/pickPackage.ts:753) rejects only unscoped names containing /, so a scoped @x/../.. passes.
Steps to reproduce Self-contained PoC (real pnpm@11.9.0; loopback tarball server; escape target is a throwaway temp dir): npm i pnpm@11.9.0 host a tarball whose package.json name = "@x/"+"../".repeat(25)+"<abs>/OUTSIDE"; victim depends on the http URL pnpm install --ignore-scripts Confirmed output (repro/poc.mjs, exit 0): escape dir is outside the project : true new file implanted outside nodemodules : true pre-existing file OVERWRITTEN : true CONFIRMED: a tarball dependency wrote & overwrote files OUTSIDE the project during pnpm install --ignore-scripts
Remediation Route the isolated-linker import-target joins (resolvePeers.ts:706, deps-resolver/index.ts:614, lockfileToDepGraph.ts:233) through safeJoinModulesDir (as the hoisted linker already does), and/or enforce validate-npm-package-name on the resolved manifest name (close the scoped-name gap at pickPackage.ts:753) so the import target rejects a traversal name and re-asserts containment before any write.
Other sources
pnpm is a package manager. Prior to 10.34.5 and 11.11.0, pnpm accepts a scoped path traversal in a tarball dependency's package.json manifest name because pnpm11/resolving/npm-resolver/src/pickPackage.ts rejects slash characters only for unscoped names. During pnpm install, the unvalidated name reaches raw path joins in pnpm11/installing/deps-resolver/src/resolvePeers.ts, pnpm11/installing/deps-resolver/src/index.ts, and pnpm11/deps/graph-builder/src/lockfileToDepGraph.ts, causing package extraction outside nodemodules and allowing attacker-controlled files to overwrite arbitrary filesystem paths even when --ignore-scripts is used. The overwrite can replace shell startup files, Git hooks, or installed package code and lead to code execution. This issue is fixed in versions 10.34.5, and 11.11.0.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/pnpmto a version that resolves this vulnerability.Fixed in 11.11.0 - Upgrade
Upgrade
npm/pnpmto a version that resolves this vulnerability.Fixed in 10.34.5 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.34.5 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 11.11.0
Event History
Frequently Asked Questions
Which installations are affected?
pnpm versions earlier than 10.34.5 and 11.11.0 are affected. The vulnerable behavior occurs when installing a tarball dependency whose package.json manifest contains a malicious scoped name.
Does using --ignore-scripts prevent exploitation?
No. The path traversal and arbitrary file overwrite occur during package extraction, even when --ignore-scripts is used. Script suppression therefore does not mitigate this issue.
What access does an attacker need?
An attacker needs to cause a user or build environment to install a malicious tarball dependency. The supplied severity vector indicates no pre-existing privileges are required, but user interaction is required.
What can be overwritten?
Attacker-controlled files can be written outside node_modules to arbitrary filesystem paths reachable by the install process. Examples identified include shell startup files, Git hooks, and installed package code, which can lead to code execution.
What should be done if affected?
Upgrade pnpm to 10.34.5 or 11.11.0. Until upgraded, avoid installing untrusted tarball dependencies, since disabling lifecycle scripts does not address the vulnerable extraction path.