CVE-2026-82393

Name of the Vulnerable Software and Affected Versions pnpm versions prior to 10.34.5 pnpm versions prior to 11.11.0

Description pnpm accepts a scoped path traversal in a tarball dependency's package.json manifest name because the pickPackage.ts function rejects slash characters only for unscoped names. During installation, the unvalidated name reaches raw path joins in resolvePeers.ts, index.ts, and lockfileToDepGraph.ts, causing package extraction outside the node modules directory. This allows attacker-controlled files to overwrite arbitrary filesystem paths, such as shell startup files, Git hooks, or installed package code, which can lead to code execution, even when the --ignore-scripts flag is used.

Recommendations Update to version 10.34.5 or later. Update to version 11.11.0 or later.