CVE-2026-82393

pnpm, a JavaScript package manager, fails to validate the name field in a tarball dependency's package.json manifest: it rejects slash characters only for unscoped names, so a crafted scoped-style name enables path traversal. During pnpm install, this unvalidated name is passed into raw path joins in the dependency resolver and graph builder, causing package files to be extracted outside node_modules. An attacker who supplies such a tarball dependency can overwrite arbitrary filesystem paths, including shell startup files, Git hooks, or installed package code, yielding code execution even when --ignore-scripts is used. Developers and CI environments running pnpm versions prior to 10.34.5 (10.x) or 11.11.0 (11.x) are affected whenever they install attacker-controlled tarball dependencies, and user interaction (an install) is required. No public proof-of-concept is known, the flaw is not in CISA KEV, and EPSS estimates only a ~0.4% chance of exploitation in the next 30 days, indicating no confirmed in-the-wild exploitation yet.

What to do: Upgrade pnpm to 10.34.5 or 11.11.0 (or later) in all developer and CI environments. As an interim measure, avoid installing dependencies from untrusted tarballs and audit lockfiles and recent installs for files written outside node_modules, modified shell startup files, or altered Git hooks. Note that --ignore-scripts does not mitigate this issue.