pacquet, the Rust component of pnpm, fails to validate dependency alias paths from a lockfile before using them in filesystem operations during installation. This oversight permits attackers to embed path traversal sequences (for example, "../../escaped-link") within alias entries. When pnpm processes an attacker‑supplied lockfile with the --trust-lockfile or frozen options, it will create symlinks, directories, or links outside the intended project and node_modules boundaries. The result is arbitrary creation and manipulation of files or directories on the local filesystem, potentially overwriting critical data or enabling subsequent exploitation steps.

The issue affects pnpm versions 12.0.0-alpha.0 through 12.0.0-alpha.4. Versions 12.0.0-alpha.5 and newer contain validation that rejects traversal, absolute, platform‑specific, or reserved names and protects the virtual‑store from unsafe entries.

The vulnerability scores a CVSS base score of 7.1, indicating medium to high severity. EPSS score is not available; the vulnerability is not listed in CISA KEV. The primary attack vector is a local attacker who can supply or influence the lockfile content. If the lockfile is not trusted, the exploitation can lead to filesystem modifications outside the project directory. Successful exploitation may lead to privilege escalation or compromise of the system file hierarchy, contingent on user privileges during pnpm execution.