CVE-2026-82393

Received Received - Intake

Path Traversal in pnpm Package Manager

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: GitHub, Inc.

Description

pnpm is a package manager. Prior to 10.34.5 and 11.11.0, pnpm accepts a scoped path traversal in a tarball dependency's package.json manifest name because pnpm11/resolving/npm-resolver/src/pickPackage.ts rejects slash characters only for unscoped names. During pnpm install, the unvalidated name reaches raw path joins in pnpm11/installing/deps-resolver/src/resolvePeers.ts, pnpm11/installing/deps-resolver/src/index.ts, and pnpm11/deps/graph-builder/src/lockfileToDepGraph.ts, causing package extraction outside node_modules and allowing attacker-controlled files to overwrite arbitrary filesystem paths even when --ignore-scripts is used. The overwrite can replace shell startup files, Git hooks, or installed package code and lead to code execution. This issue is fixed in versions 10.34.5, and 11.11.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-31

Last Modified

2026-08-31

Generated

2026-09-01

AI Q&A

2026-09-01

EPSS Evaluated

N/A

NVD

CVE-2026-82393

Affected Vendors & Products

Vendor	Product	Version / Range
pnpm	pnpm	to 10.34.5 (inc)
pnpm	pnpm	to 11.11.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-73	The product allows user input to control or influence paths or file names that are used in filesystem operations.
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

This vulnerability in pnpm versions before 10.34.5 and 11.11.0 allows a scoped path traversal attack through a tarball dependency's package.json manifest name. The issue occurs because the package manager fails to properly validate scoped names containing slashes, leading to unvalidated paths during package installation.

Detection Guidance

To detect this vulnerability, check the installed pnpm version with 'pnpm --version'. If it is below 10.34.5 or 11.11.0, the system is vulnerable. Additionally, review package.json files for tarball dependencies with scoped path traversal in manifest names.

Impact Analysis

An attacker could exploit this to overwrite arbitrary filesystem paths outside node_modules, including shell startup files, Git hooks, or installed package code. This could lead to code execution even when --ignore-scripts is used, potentially compromising the entire system.

Compliance Impact

This vulnerability could lead to unauthorized file overwrites, potentially exposing sensitive data or violating data integrity requirements under GDPR and HIPAA. Attackers could replace critical files like shell scripts or Git hooks to execute malicious code, compromising system security and confidentiality.

Mitigation Strategies

Update pnpm to version 10.34.5 or later, or 11.11.0 or later. This fixes the path traversal issue in tarball dependencies. Verify the update with 'pnpm --version'.

Hi! I’m here to help you understand CVE-2026-82393. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70