pnpm EUVD-2026-39494

Exploitation requires that the victim run a pnpm install (UI:R) with a vulnerable pnpm version (<10.34.0 or <11.4.0) and that the dependency graph resolve a package whose registry metadata supplies a transitive dependency alias containing path-traversal (../) segments - i.e., the attacker must control or compromise a package that lands in the project's transitive dependencies. Notably, enabling --ignore-scripts does NOT prevent it, so that common hardening setting is not a limiting factor. Limiting factors are: the attacker must get a malicious package into resolution (direct add or transitive pull-in), an install must actually be executed, and the pnpm binary must be unpatched; no attacker authentication to the victim system and no lifecycle scripts are needed.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H = 8.8) reflects a network-delivered, low-complexity attack requiring only that a victim install an affected dependency (UI:R). The most operationally significant detail is that exploitation works under --ignore-scripts, the exact mitigation many teams rely on against malicious packages, so a common compensating control does not apply here. No EPSS score, KEV listing, or POC was supplied: this is a real and credible supply-chain integrity risk but, on available evidence, there is no public exploit identified at time of analysis and no confirmed active exploitation, so it should be patched promptly rather than treated as an in-progress incident. One caveat to verify: the official vector rates C:H, but the described primitive (symlink replacement) is most directly an integrity/availability issue - confidentiality impact is plausible (symlinking secrets into readable locations) but second-order, so treat C:H as vendor-assigned rather than self-evident.

An attacker publishes (or compromises) a package whose metadata declares a transitive dependency alias containing ../ path-traversal segments, then gets it into a victim's dependency tree directly or as a transitive dependency. When the victim runs pnpm install - even with --ignore-scripts - pnpm links that alias to a path outside node_modules, replacing project files or directories with symlinks to attacker-controlled dependency content, which can lead to code execution on next build or run. No public POC is identified at time of analysis, but the low attack complexity makes weaponization straightforward once the malicious package is in the resolution graph.