Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
pnpm is a package manager. Prior to 10.34.5 and 11.11.0, pnpm accepts a scoped path traversal in a tarball dependency's package.json manifest name because pnpm11/resolving/npm-resolver/src/pickPackage.ts rejects slash characters only for unscoped names. During pnpm install, the unvalidated name reaches raw path joins in pnpm11/installing/deps-resolver/src/resolvePeers.ts, pnpm11/installing/deps-resolver/src/index.ts, and pnpm11/deps/graph-builder/src/lockfileToDepGraph.ts, causing package extraction outside node_modules and allowing attacker-controlled files to overwrite arbitrary filesystem paths even when --ignore-scripts is used. The overwrite can replace shell startup files, Git hooks, or installed package code and lead to code execution. This issue is fixed in versions 10.34.5, and 11.11.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
Warning: Critical Path Traversal in #pnpm. #CVE-2026-82392 CVSS: 7.1 & #CVE-2026-82393 CVSS: 7.5. These vulnerabilities can lead to remote code execution #RCE. #Patch #Patch #Patch
Post summary
The tweet announces two critical path traversal vulnerabilities in pnpm (CVE‑2026‑82392 and CVE‑2026‑82393), indicating their CVSS scores, potential for remote code execution, and the availability of a patch.
🚨High - pnpm Tarball Dependency Path Traversal via Scoped Manifest Name (CVE-2026-82393) pnpm improperly validates scoped package names in tarball dependencies: a crafted manifest "name" is used in raw path joins during package resolution/install, enabling ../ traversal and extraction outside node_modules. This allows arbitrary file overwrite even with --ignore-scripts, leading to code execution via overwritten shell rc files, Git hooks, or package code. 👉Affected: pnpm (versions unknown)
Post summary
The post discloses a high‑severity CVE‑2026‑82393 wherein pnpm fails to validate scoped package names, enabling path traversal, file overwrite, and potential code execution. It provides technical details but no PoC, exploit, or patch information.