Description

pnpm is a package manager. Prior to 10.34.5 and 11.11.0, pnpm accepts a scoped path traversal in a tarball dependency's package.json manifest name because pnpm11/resolving/npm-resolver/src/pickPackage.ts rejects slash characters only for unscoped names. During pnpm install, the unvalidated name reaches raw path joins in pnpm11/installing/deps-resolver/src/resolvePeers.ts, pnpm11/installing/deps-resolver/src/index.ts, and pnpm11/deps/graph-builder/src/lockfileToDepGraph.ts, causing package extraction outside node_modules and allowing attacker-controlled files to overwrite arbitrary filesystem paths even when --ignore-scripts is used. The overwrite can replace shell startup files, Git hooks, or installed package code and lead to code execution. This issue is fixed in versions 10.34.5, and 11.11.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-31T22:17:22.353Z",
  "pubdate": "2026-08-31T22:17:22.353Z",
  "executiveSummary": "A critical path traversal vulnerability exists in pnpm, a package manager for the Node.js ecosystem, affecting versions prior to 10.34.5 and 11.11.0. The vulnerability stems from improper input validation of the package name field within tarball dependency manifests (package.json).\nAn attacker can exploit this flaw by crafting a malicious package containing a scoped name with path traversal sequences. During the installation process, pnpm fails to adequately sanitize these scoped names, allowing the package manager to extract files outside of the designated node_modules directory.\nThis vulnerability enables arbitrary file overwrite, effectively granting an attacker the capability to modify sensitive system files, shell startup scripts, or Git hooks. Consequently, this can lead to Remote Code Execution (RCE) on the developer's machine or CI/CD environment, even when security flags such as --ignore-scripts are actively employed. The risk is considered high due to the potential for complete system compromise and the ability to bypass standard package installation security controls.",
  "technicalDetails": "The root cause of this vulnerability lies in an incomplete validation logic within the package resolution mechanism. Specifically, in pnpm11/resolving/npm-resolver/src/pickPackage.ts, the validator only enforces restrictions on slash characters for unscoped package names, failing to apply the same rigor to scoped names (e.g., @scope/package-name).\nWhen a tarball dependency is processed, the malicious package manifest provides a name field containing traversal sequences like '@scope/../../../../etc/passwd'. Because the validation logic is bypassed for scoped entities, this traversal string persists through the resolution phase.\nThe attack flow proceeds as follows: 1. The attacker publishes a malicious package to a registry or hosts a malicious tarball. 2. A victim executes an installation command (e.g., 'pnpm install') targeting the malicious package. 3. The vulnerable component, failing to sanitize the scoped name, allows the malicious path to propagate into critical internal modules. 4. The unvalidated name is subsequently passed to raw path joining operations in multiple components, specifically pnpm11/installing/deps-resolver/src/resolvePeers.ts, pnpm11/installing/deps-resolver/src/index.ts, and pnpm11/deps/graph-builder/src/lockfileToDepGraph.ts.\nDuring the installation of these dependencies, the filesystem extraction process utilizes the malicious path string to resolve the destination directory. Due to the path traversal sequences, the extraction logic escapes the sandbox constraints of the project's node_modules directory, targeting arbitrary locations on the host filesystem with the permissions of the user running the pnpm command.\nExploitation does not require authentication to the target system but necessitates that the victim installs the malicious package. The impact is significant: because the files are written by the package manager, the attacker can overwrite executable binaries, shell configuration files (e.g., .bashrc, .zshrc), or critical project configuration files. By modifying these files, an attacker can achieve arbitrary code execution upon the next login or execution of system commands by the victim. Notably, this attack vector functions independently of the --ignore-scripts flag, as the malicious file placement occurs during the file extraction phase, circumventing the execution prevention mechanism of the package lifecycle scripts."
}