CVE-2026-82393: pnpm Path Traversal Vulnerability

CVE-2026-82393 Overview

CVE-2026-82393 is a path traversal vulnerability [CWE-22] in the pnpm package manager affecting all versions prior to 10.34.5 and 11.11.0. The flaw resides in pnpm11/resolving/npm-resolver/src/pickPackage.ts, which rejects slash characters only for unscoped package names. A malicious tarball dependency can declare a scoped name in its package.json manifest containing traversal sequences, which then flows unvalidated into raw path joins during dependency resolution and extraction. Exploitation allows package files to be written outside node_modules, overwriting arbitrary filesystem paths even when --ignore-scripts is set.

Critical Impact
Attackers publishing crafted npm packages can overwrite shell startup files, Git hooks, or installed package code during pnpm install, leading to arbitrary code execution on developer and CI systems.

Affected Products

pnpm versions prior to 10.34.5 (v10 branch)
pnpm versions prior to 11.11.0 (v11 branch)
Any Node.js project or CI pipeline consuming untrusted tarball dependencies via pnpm

Discovery Timeline

2026-08-31 - CVE-2026-82393 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2026-82393

Vulnerability Analysis

The vulnerability arises because pnpm's name-validation logic in pickPackage.ts enforces slash restrictions only against unscoped package names. Scoped names of the form @scope/name bypass that filter, allowing arbitrary path separators and .. traversal sequences inside the name field of a dependency's package.json manifest.

During pnpm install, the unvalidated name propagates into raw path-join operations in pnpm11/installing/deps-resolver/src/resolvePeers.ts, pnpm11/installing/deps-resolver/src/index.ts, and pnpm11/deps/graph-builder/src/lockfileToDepGraph.ts. Because the extraction target is computed by joining these attacker-controlled segments against the store or node_modules root, tarball contents can be written anywhere the pnpm process has write access. The --ignore-scripts flag does not mitigate this issue, since the write occurs during extraction and not through a lifecycle script.

Root Cause

The root cause is inconsistent input validation. The name filter treated the / character as illegal only for unscoped identifiers, treating scoped names as pre-sanitized. Downstream code assumed the name was safe and used it directly in path.join calls without containment checks against the intended output directory.

Attack Vector

An attacker publishes a tarball dependency whose package.json manifest declares a scoped name containing traversal segments. When a victim runs pnpm install and resolves that dependency, either directly or transitively, extraction writes files to attacker-chosen filesystem paths. Overwritten targets can include shell rc files, .git/hooks/*, or on-disk copies of already-installed packages, resulting in code execution the next time those artifacts are loaded.

typescript

// Patch excerpt: deps/graph-builder/src/lockfileToDepGraph.ts
// Introduces safeJoinModulesDir to contain path composition
  type FetchResponse,
  type StoreController,
} from '@pnpm/store-controller-types'
import { safeJoinModulesDir } from '@pnpm/symlink-dependency'
import * as dp from '@pnpm/dependency-path'
import pathExists from 'path-exists'
import equals from 'ramda/src/equals'

Source: GitHub Commit 78e29fe

Detection Methods for CVE-2026-82393

Indicators of Compromise

Files created or modified outside the project's node_modules directory during or immediately after a pnpm install invocation.
Unexpected changes to shell startup files such as ~/.bashrc, ~/.zshrc, or ~/.profile on developer or CI hosts running pnpm.
New or altered Git hook scripts under .git/hooks/ that were not committed by a developer.
Dependency manifests containing scoped name fields with / or .. sequences beyond the single scope separator.

Detection Strategies

Audit pnpm-lock.yaml for package entries whose name fields contain path separators beyond the initial scope segment.
Instrument CI runners to snapshot filesystem state before and after pnpm install and alert on writes outside the project workspace.
Correlate process execution telemetry for pnpm with subsequent file writes to sensitive directories such as user home, .git, or system-wide package stores.

Monitoring Recommendations

Track pnpm version inventory across developer endpoints and build agents to identify hosts still running versions below 10.34.5 or 11.11.0.
Monitor EDR file-integrity events for shell rc files and Git hooks on engineering workstations.
Log and review outbound registry resolutions from CI to catch newly introduced dependencies from untrusted publishers.

How to Mitigate CVE-2026-82393

Immediate Actions Required

Upgrade pnpm to 10.34.5 on the v10 branch or 11.11.0 on the v11 branch across all developer workstations and build systems.
Rebuild container images and CI caches that were produced with vulnerable pnpm versions to remove any tampered artifacts.
Review recent pnpm install runs against untrusted or newly added dependencies and inspect the filesystem for unexpected writes.

Patch Information

The pnpm maintainers fixed the issue in releases v10.34.5 and v11.11.0. The fix introduces a safeJoinModulesDir helper and containment checks for lockfile and manifest package names. See GitHub Security Advisory GHSA-vq4v-j7r6-jq4m, Pull Request #12872, and Pull Request #12890 for the full change set.

Workarounds

Restrict pnpm install to vetted internal registries or lockfile-pinned dependencies from trusted publishers until upgrading is complete.
Run pnpm inside an ephemeral, unprivileged container or sandbox so any out-of-tree writes cannot reach persistent developer or CI state.
Enforce code review on any change to package.json or pnpm-lock.yaml that introduces new dependencies or unusual scoped names.

bash

# Upgrade pnpm to a patched release
npm install -g pnpm@11.11.0
# Or, for the v10 branch
npm install -g pnpm@10.34.5

# Verify installed version
pnpm --version