Technical impact
This vulnerability exists in pnpm versions prior to 10.34.2 and 11.5.3. It occurs when a malicious global package contains reserved bin names such as "." or "..". The bin-name guard is bypassed for these keys, and during later global remove, update, or add-replacement flows pnpm reconstructs the bin names from the installed manifest and passes a path that can target the global bin directory or its parent. When resolved with path.join, the operation deletes the target directory, potentially wiping out the entire PNPM_HOME environment and all globally installed packages. The weakness falls under CWE-22 (Path Traversal) and CWE-73 (Path Manipulation).
Affected Systems
The affected product is the pnpm package manager. Users of pnpm running any version older than 10.34.2 on the 10.x line or older than 11.5.3 on the 11.x line are vulnerable. The issue is limited to the global installation context for npm packages.
Risk and Exploitability
The CVSS score of 6.5 reflects a moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a malicious package to be installed globally, so the attack vector is local. An attacker with permission to install or modify packages can cause accidental deletion of critical directories, resulting in data loss or service disruption. The risk level is moderate, but the impact can be significant for users who rely on global pnpm installations.
Github GHSA