pnpm CVE-2026-82393

The victim must run pnpm install or any pnpm command triggering dependency resolution against a project whose dependency graph includes a package with a scoped name containing .. path-traversal sequences. This can originate from a package.json declaration or from a crafted pnpm-lock.yaml; the regression tests in PR #12872 confirm the lockfile vector succeeds even under --frozen-lockfile --trust-lockfile, meaning trust-lockfile mode does not prevent exploitation. The --ignore-scripts flag provides no protection because the file overwrite occurs through the extraction pipeline, not npm lifecycle scripts. Exploitation is limited to pnpm v10 before 10.34.5 and v11 before 11.11.0; npm and yarn are not affected by this validator gap. The attacker must control or compromise the source of a dependency in the victim's graph, either by publishing to a registry the victim trusts or by poisoning a lockfile committed to the project.

The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) scores 7.5. AC:H is well-calibrated: the attacker must place a malicious scoped-name package into the victim's dependency graph via a registry or lockfile compromise, requiring meaningful social engineering or supply-chain access. S:U in the provided vector is arguably under-scored, as file writes escape node_modules to arbitrary filesystem paths including system-wide directories, which implies scope change; this analysis assesses S:C instead. No EPSS data is available in the provided intelligence. The CVE is not listed in CISA KEV, confirming no known active exploitation at time of analysis. The --ignore-scripts bypass is the primary severity amplifier: developers in supply-chain-aware environments frequently rely on this flag as a compensating control, and this vulnerability invalidates that assumption entirely. The realistic exploitation path (convince a developer to install a malicious package) is consistent with documented supply-chain attack campaigns and warrants prompt patching despite the AC:H rating.

An attacker publishes a convincingly named npm package under a scoped identifier embedding a path-traversal sequence, such as @legitimate-org/../../../home/developer/.gitconfig, and either submits it as a transitive dependency update or persuades the victim to add it directly. When the developer runs pnpm install - even with --ignore-scripts - pnpm's extraction pipeline resolves the traversal and writes package contents to the developer's home directory, silently replacing their Git configuration. On the next git commit or push, a malicious Git hook executes with the developer's full privileges.