The vulnerability arises when a crafted alias in a pnpm lockfile is resolved directly into a hoisted node_modules directory. If the alias contains path traversal sequences or uses reserved names such as .bin or .pnpm, the resolved path may escape the intended subtree or overwrite files that pnpm manages, allowing a malicious actor to place arbitrary content inside the installation layout. This flaw corresponds to Path Traversal (CWE-22) and improper handling of relative paths (CWE-73). Based on the description, it is inferred that the attacker can supply a malicious lockfile during a pnpm install to exploit the issue.

The issue affects pnpm installations older than version 10.34.4 and 11.7.0. Users that run those releases and consume lockfiles from untrusted sources, especially in build or deployment pipelines, are susceptible to the problem.

The CVSS score of 7.1 indicates a high severity. The EPSS score is below 1%, indicating a very low likelihood of active exploitation, and the vulnerability is not listed in CISA's KEV catalog, so no widespread, verified exploits are known. Attackers would need to supply a malicious lockfile during a pnpm install, a scenario commonly encountered in continuous-integration environments or where external lockfiles are fetched from registries. Based on the description, it is inferred that the primary attack vector involves supplying a crafted lockfile presented to pnpm, typically by a malicious source or compromised registry, with the install performed by a user having write access to the node_modules tree.