During pnpm installation, a tarball dependency’s package.json can include a scoped name that contains slash characters. pnpm does not reject these slashes for scoped names, allowing the name to be passed directly into raw path joins. The result is extraction of files outside the intended node_modules directory, enabling an attacker who controls the tarball contents to overwrite arbitrary filesystem paths, such as shell startup files, Git hooks, or executable package code. The flaw is a form of path traversal (CWE‑22, CWE‑73) and can lead to code execution (CWE‑94).

Any deployment that uses pnpm versions older than 10.34.5 or 11.11.0 is vulnerable. The weakness exists in the core install logic and does not depend on platform or user permissions beyond running pnpm install. All projects that include a malicious or compromised tarball dependency are at risk, regardless of operating system.

The CVSS score of 7.5 indicates a high impact vulnerability. EPSS information is currently not available, and the flaw is not listed in CISA’s KEV catalog. The attack vector is likely to be present when a user runs pnpm install against a registry that hosts a malicious tarball or when an attacker gains the ability to modify a dependency’s tarball contents. By supplying a tarball with a crafted package.json name, an attacker can overwrite critical files on the filesystem during normal dependency installation, potentially achieving code execution or privilege escalation. The upstream fix in pnpm 10.34.5 and 11.11.0 removes the validation flaw, closing the path through which arbitrary paths could be extracted.