p PatchFirst

CVE-2026-82393

CVE-2026-82393 · pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

pnpm is a package manager. Prior to 10.34.5 and 11.11.0, pnpm accepts a scoped path traversal in a tarball dependency's package.json manifest name because pnpm11/resolving/npm-resolver/src/pickPackage.ts rejects slash characters only for unscoped names. During pnpm install, the unvalidated name reaches raw path joins in pnpm11/installing/deps-resolver/src/resolvePeers.ts, pnpm11/installing/deps-resolver/src/index.ts, and pnpm11/deps/graph-builder/src/lockfileToDepGraph.ts, causing package extraction outside node_modules and allowing attacker-controlled files to overwrite arbitrary filesystem paths even when --ignore-scripts is used. The overwrite can replace shell startup files, Git hooks, or installed package code and lead to code execution. This issue is fixed in versions 10.34.5, and 11.11.0.

CVSS 7.5 · Alta · EPSS 0,6% · Corrección disponible

Publicación
Actualización

Pila tecnológica: node

Productos y versiones afectados

  • pnpm

    Versiones
    • < 10.34.5: Afectada
    • >= 11.0.0, < 11.11.0: Afectada

    Sin corrección publicada

  • pnpm npm

    Intervalos de versiones afectados
    • SEMVER: < 10.34.5

    Actualiza a 10.34.5

  • pnpm npm

    Intervalos de versiones afectados
    • SEMVER: ≥ 11.0.0, < 11.11.0

    Actualiza a 11.11.0

Fuentes originales

Comprueba tu servidor →