CVE-2026-82393
highpnpm is a package manager.
pnpm is a package manager. Prior to 10.34.5 and 11.11.0, pnpm accepts a scoped path traversal in a tarball dependency's package.json manifest name because pnpm11/resolving/npm-resolver/src/pickPackage.ts rejects slash characters only for unscoped names. During pnpm install, the unvalidated name reaches raw path joins in pnpm11/installing/deps-resolver/src/resolvePeers.ts, pnpm11/installing/deps-resolver/src/index.ts, and pnpm11/deps/graph-builder/src/lockfileToDepGraph.ts, causing package extraction outside node_modules and allowing attacker-controlled files to overwrite arbitrary filesystem paths even when --ignore-scripts is used. The overwrite can replace shell startup files, Git hooks, or installed package code and lead to code execution. This issue is fixed in versions 10.34.5, and 11.11.0.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/pnpm/pnpm/commit/51300fd41c5e4c8f47635108e373cc3d1f324fa7 security-advisories@github.com
- https://github.com/pnpm/pnpm/commit/78e29fe5583a1e5d69ea05e414eff310f78d5ed9 security-advisories@github.com
- https://github.com/pnpm/pnpm/pull/12872 security-advisories@github.com
- https://github.com/pnpm/pnpm/pull/12890 security-advisories@github.com
- https://github.com/pnpm/pnpm/releases/tag/v10.34.5 security-advisories@github.com
- https://github.com/pnpm/pnpm/releases/tag/v11.11.0 security-advisories@github.com
- https://github.com/pnpm/pnpm/security/advisories/GHSA-vq4v-j7r6-jq4m security-advisories@github.com
- https://github.com/pnpm/pnpm/security/advisories/GHSA-vq4v-j7r6-jq4m 134c704f-9b21-4f2e-91b3-4a467353bcc0