CVE-2026-82393 pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install
A malicious tarball dependency can overwrite arbitrary files during installation, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-82393?
CVE-2026-82393 is a high-severity path traversal vulnerability in pnpm, published on 31 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
pnpm is a package manager. Prior to 10.34.5 and 11.11.0, pnpm accepts a scoped path traversal in a tarball dependency's package.json manifest name because pnpm11/resolving/npm-resolver/src/pickPackage.ts rejects slash characters only for unscoped names. During pnpm install, the unvalidated name reaches raw path joins in pnpm11/installing/deps-resolver/src/resolvePeers.ts, pnpm11/installing/deps-resolver/src/index.ts, and pnpm11/deps/graph-builder/src/lockfileToDepGraph.ts, causing package extraction outside node_modules and allowing attacker-controlled files to overwrite arbitrary filesystem paths even when --ignore-scripts is used. The overwrite can replace shell startup files, Git hooks, or installed package code and lead to code execution. This issue is fixed in versions 10.34.5, and 11.11.0.
Which versions are affected by CVE-2026-82393?
4 open source packages ship an affected version, including pnpm.
| Package | Affected | Fixed in |
|---|---|---|
pnpm npm | All versions | 10.34.5 |
pnpm npm | All versions | 10.34.5 |
pnpm npm | From 11.0.0 | 11.11.0 |
pnpm npm | From 11.0.0 | 11.11.0 |
How do I fix CVE-2026-82393?
Upgrade pnpm to a fixed version for your release line: 10.34.5 or 11.11.0.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-82393 being exploited?
There is no known exploitation of CVE-2026-82393 in the wild and no public exploit code.
Sources
Also known as GHSA-vq4v-j7r6-jq4m, MINI-3fq7-97cq-8r7q.