pnpm, before version 10.28.2, processes a package’s directories.bin field without validating that the resolved path remains inside the package root. A malicious npm package can set directories.bin to a value such as "../../../../tmp", causing pnpm to use path.join() to build a path that points outside the package. The resulting path is then chmod‑ed to 755, giving the attacker the ability to modify the permissions of any file the pnpm process can reach, potentially granting elevated privileges or enabling other subsequent attacks.

The vulnerability affects the pnpm package manager on Unix‑like operating systems—Linux, macOS, and other Unix variants—when installed at any version earlier than 10.28.2. Windows is not impacted because the potential exploit path is guarded by the EXECUTABLE_SHEBANG_SUPPORTED condition. Anyone using pnpm to install packages from untrusted registries or local sources is at risk.

The vulnerability received a CVSS score of 6.7, indicating moderate severity. However, the EPSS score is reported as < 1%, so the likelihood of exploitation is currently low. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to supply a malicious package; once delivered, the attack can be carried out locally by the user running pnpm, allowing changes to arbitrary file permissions under that user’s filesystem scope.