pnpm is a package manager. Prior to 10.34.5 and 11.11.0, pnpm accepts a scoped path traversal in a tarball dependency's package.json manifest name because pnpm11/resolving/npm-resolver/src/pickPackage.ts rejects slash characters only for unscoped names. During pnpm install, the unvalidated name reaches raw path joins in pnpm11/installing/deps-resolver/src/resolvePeers.ts, pnpm11/installing/deps-resolver/src/index.ts, and pnpm11/deps/graph-builder/src/lockfileToDepGraph.ts, causing package extraction outside node_modules and allowing attacker-controlled files to overwrite arbitrary filesystem paths even when --ignore-scripts is used. The overwrite can replace shell startup files, Git hooks, or installed package code and lead to code execution. This issue is fixed in versions 10.34.5, and 11.11.0.

A path traversal vulnerability in pnpm package manager (prior to versions 10.34.5 and 11.11.0) allows attackers to overwrite arbitrary filesystem paths during package installation. The flaw exists because pnpm's pickPackage.ts only rejects slash characters in unscoped package names, leaving scoped names unvalidated. The unvalidated name is then used in raw path joins across multiple source files, enabling package extraction outside the intended node_modules directory. Attackers can craft malicious tarball dependencies whose package.json manifest names exploit this bypass. The attack can overwrite critical files such as shell startup scripts, Git hooks, or installed package code, ultimately leading to arbitrary code execution. Critically, the vulnerability persists even when the --ignore-scripts flag is used, bypassing a common security mitigation. The issue has been patched in pnpm versions 10.34.5 and 11.11.0.