Vulnerability Description
pnpm is a package manager. Prior to 10.34.5 and 11.11.0, pnpm accepts a scoped path traversal in a tarball dependency's package.json manifest name because pnpm11/resolving/npm-resolver/src/pickPackage.ts rejects slash characters only for unscoped names. During pnpm install, the unvalidated name reaches raw path joins in pnpm11/installing/deps-resolver/src/resolvePeers.ts, pnpm11/installing/deps-resolver/src/index.ts, and pnpm11/deps/graph-builder/src/lockfileToDepGraph.ts, causing package extraction outside node_modules and allowing attacker-controlled files to overwrite arbitrary filesystem paths even when --ignore-scripts is used. The overwrite can replace shell startup files, Git hooks, or installed package code and lead to code execution. This issue is fixed in versions 10.34.5, and 11.11.0.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/pnpm/pnpm/commit/51300fd41c5e4c8f47635108e373cc3d1f324fa7
- https://github.com/pnpm/pnpm/commit/78e29fe5583a1e5d69ea05e414eff310f78d5ed9
- https://github.com/pnpm/pnpm/pull/12872
- https://github.com/pnpm/pnpm/pull/12890
- https://github.com/pnpm/pnpm/releases/tag/v10.34.5
- https://github.com/pnpm/pnpm/releases/tag/v11.11.0
- https://github.com/pnpm/pnpm/security/advisories/GHSA-vq4v-j7r6-jq4m
- https://github.com/pnpm/pnpm/security/advisories/GHSA-vq4v-j7r6-jq4m
FAQ
What is CVE-2026-82393?
CVE-2026-82393 is a vulnerability with a CVSS score of 7.5 (HIGH). pnpm is a package manager. Prior to 10.34.5 and 11.11.0, pnpm accepts a scoped path traversal in a tarball dependency's package.json manifest name because pnpm11/resolving/npm-resolver/src/pickPackage...
How severe is CVE-2026-82393?
CVE-2026-82393 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-82393?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.