Executive brief
pnpm is a popular package manager for JavaScript projects. A vulnerability in its 'stage download' command allows a malicious package manifest to trick the tool into writing files outside of the intended download directory. This could allow an attacker to overwrite sensitive files on a developer's machine or a build server, potentially leading to system instability or unauthorized code execution.
Technical details
A path traversal vulnerability (CWE-22/CWE-73) exists in pnpm's `stage download` command. The root cause is the improper neutralization of package name and version fields from registry-controlled manifests when deriving local filenames. An attacker can craft a manifest with traversal sequences (e.g., ../) in these fields to escape the designated download directory and overwrite arbitrary reachable files. Exploitation requires a user to run the affected command against a malicious manifest. The vulnerability is fixed in version 11.5.3 by implementing strict validation of package names and versions and verifying that the final resolved path remains within the target directory.
Affected products
- pnpm pnpm >= 11.3.0, < 11.5.3
Timeline
- 2026-06-15: disclosed: Initial disclosure by zkochan
- 2026-06-25: advisory: NVD publication
- 2026-06-26: patched: GitHub Advisory reviewed and updated