Listen to this Post
When resolving a package, pnpm uses the resolved manifest name as a raw path segment for the isolated-linker import target. A tarball dependency whose `package.json` name is a scoped path traversal (@x/../../…/<abs path>) is therefore extracted outside node_modules, to an attacker-chosen absolute path, and can overwrite existing files there. Attacker controls the destination, filenames, and contents → arbitrary file write → code execution (e.g. ~/.zshrc, .git/hooks/pre-commit, another package’s code). Occurs during `pnpm install` even with `–ignore-scripts` (no lifecycle scripts run), defeating that safety.
Same class as the just-patched GHSA-hwx4 (transitive-dependency alias traversal) and GHSA-v23m (stage download manifest name/version traversal), in a sink their fixes did not cover: the isolated-linker import target keyed by the resolved name.
Root Cause
The isolated-linker import target is built with a raw `path.join(modules, installing/deps-resolver/src/resolvePeers.ts:706, installing/deps-resolver/src/index.ts:614, and `deps/graph-builder/src/lockfileToDepGraph.ts:233` — without the `safeJoinModulesDir` guard used on the symlink/hoisted bin paths (installing/deps-restorer/src/lockfileToHoistedDepGraph.ts:222). The store location is node_modules/.pnpm/<id>/node_modules/<name>, so a traversal `
The only resolve-time name gate (resolving/npm-resolver/src/pickPackage.ts:753) rejects only unscoped names containing /, so a scoped `@x/../..` passes.
Steps to Reproduce
Self-contained PoC (real [email protected]; loopback tarball server; escape target is a throwaway temp dir):
npm i [email protected] host a tarball whose package.json name = "@x/"+"../".repeat(25)+"<abs>/OUTSIDE"; victim depends on the http URL pnpm install --ignore-scripts
Confirmed output (`repro/poc.mjs`, exit 0):
escape dir is outside the project : true new file implanted outside node_modules : true pre-existing file OVERWRITTEN : true CONFIRMED: a tarball dependency wrote & overwrote files OUTSIDE the project during `pnpm install --ignore-scripts`
Remediation
Route the isolated-linker import-target joins (resolvePeers.ts:706, deps-resolver/index.ts:614, lockfileToDepGraph.ts:233) through `safeJoinModulesDir` (as the hoisted linker already does), and/or enforce `validate-npm-package-name` on the resolved manifest name (close the scoped-name gap at pickPackage.ts:753) so the import target rejects a traversal name and re-asserts containment before any write.
DailyCVE Form
Platform: pnpm
Version: <10.34.5, <11.11.0
Vulnerability: Path Traversal
Severity: High (CVSS 7.5)
Date: 2026-09-01
Prediction: 2026-07-10 (v10.34.5, v11.11.0)
What Undercode Say
Analytics
- Attack vector: Remote, requires user interaction (
pnpm install) - Exploitability: Difficult; special conditions may be required
- EPSS: 0.41% (very low probability in next 30 days)
- Exploit availability: No public exploit available
- Exploitation attempts: Detected
Bash Commands & Code (Educational Purposes)
Check pnpm version:
pnpm --version
Vulnerable versions (before fix):
Returns true if vulnerable [[ $(pnpm --version) < 10.34.5 || ($(pnpm --version) >= 11.0.0 && $(pnpm --version) < 11.11.0) ]] && echo "Vulnerable"
PoC concept (malicious `package.json` name field):
{
"name": "@x/../../../../../home/user/.zshrc",
"version": "1.0.0"
}
Exploit: (Educational Purposes!)
- Attacker hosts a tarball with a crafted `package.json` where the `name` field contains path traversal sequences (e.g.,
@x/../../../<abs path>) - Victim runs `pnpm install` with a dependency pointing to the attacker’s tarball URL
3. The unvalidated scoped name bypasses `pickPackage.ts` validation
- The name reaches raw `path.join()` in the isolated linker
- Package contents extract outside `node_modules` to the attacker-chosen absolute path
- Arbitrary files (shell startup files, Git hooks, package code) are overwritten
- Code execution occurs when the overwritten file is later executed (e.g., next shell session, Git commit)
Protection
- Upgrade pnpm to version 10.34.5 or 11.11.0 or later
- Verify dependency sources before installation
- Use `–ignore-scripts` does not protect against this vulnerability
- Audit `pnpm-lock.yaml` for suspicious path traversal sequences in package names
- Monitor file system writes outside `node_modules` during installation
Impact
- Arbitrary File Write/Overwrite: Attacker can write to any path the user running `pnpm install` has permissions for
- Code Execution: Overwriting shell startup files (
.bashrc,.zshrc) or Git hooks (.git/hooks/pre-commit) leads to code execution on next shell session or Git operation - Bypasses
--ignore-scripts: The vulnerability exploits filesystem manipulation, not lifecycle scripts, so the safety flag is ineffective - CI/CD Risk: Particularly dangerous in automated build environments where dependencies are installed without interactive oversight
- Supply Chain Attack: Malicious registry packages or tarball dependencies can compromise all consumers
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
