pnpm versions prior to 10.34.2 and 11.5.3 incorrectly strip parenthesized text from git, URL, tarball, and other locators during peer‑suffix normalisation. This behaviour allows an attacker to supply a source string that normalises to the same value as an already approved source. The vulnerability is a classic identity spoofing flaw (CWE‑346) that can be exploited to install malicious code under the guise of an authorised dependency, potentially enabling arbitrary code execution during build or run time.

All installations of the pnpm package manager running an affected version – specifically pnpm 10.x before 10.34.2 and pnpm 11.x before 11.5.3 – are at risk. Any user or continuous‑integration environment that resolves external dependencies with these pnpm versions would be exposed.

The CVSS score of 7.5 indicates a moderate‑to‑high severity. No EPSS value is publicly available, and the vulnerability is not currently listed in the CISA KEV catalog. An attacker who can influence the dependency specification (for example by modifying package.json or the lockfile in a CI pipeline) could supply a crafted source that bypasses approval checks, causing pnpm to fetch and execute malicious code. Based on the description, it is inferred that an attacker could trigger the attack remotely if they control the publishing of a package that is subsequently fetched by vulnerable pnpm installations.