CVE-2026-82393: pnpm Arbitrary File Write Vulnerability Due to Manifest Name Escaping
Summary
CVE-2026-82393: When resolving a package, pnpm uses the resolved manifest name as a raw path segment for the isolated-linker import target. Affects pnpm across 2 version ranges.
< 10.34.5
>= 11.0.0, < 11.11.0
Fixed in 10.34.5 or 11.11.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pnpm is a fast, disk space-efficient package manager for JavaScript and Node.js applications. It utilizes a unique approach to package installation by creating a non-flat node_modules structure, which allows for better dependency management and reduced disk space usage. However, pnpm is vulnerable to a serious issue where a tarball dependency's manifest name can escape the node_modules directory, leading to arbitrary file write and potential code execution.
Vulnerability Detail
The vulnerability arises from the way pnpm resolves package dependencies. When a package is installed, pnpm uses the resolved manifest name as a raw path segment for the isolated-linker import target. If a tarball dependency's package.json name is crafted as a scoped path traversal (e.g., '@x/../../<abs path>'), it can be extracted outside of the node_modules directory to an attacker-controlled absolute path. This allows the attacker to overwrite existing files, leading to arbitrary file write and potential code execution, even when lifecycle scripts are ignored during installation.
How To Fix
Latest published version: 12.15.0 as of 23 Oct 2026
npm install pnpm@12.15.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 10.34.510.34.5npm install pnpm@10.34.5 -
>= 11.0.0, < 11.11.011.11.0npm install pnpm@11.11.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid installing untrusted tarball dependencies or ensure that the package names do not contain path traversal sequences. Additionally, consider using the npm audit command to check for vulnerabilities in your dependencies.
Conclusion
The CVE-2026-82393 vulnerability in pnpm poses a significant risk due to its ability to allow arbitrary file writes through crafted tarball dependencies. It is crucial for users of pnpm to update to the patched versions to mitigate this risk and to be cautious when handling untrusted dependencies.
See every vulnerability recorded for pnpm →
FAQ
CVE-2026-82393 is a vulnerability in pnpm that allows an attacker to exploit a tarball dependency's manifest name to write or overwrite files outside of the node_modules directory.
If your application uses pnpm and installs untrusted tarball dependencies, it may be at risk of arbitrary file writes, which could lead to code execution or data loss.
Versions of pnpm prior to 10.34.5 and 11.11.0 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By uploading your package-lock.json file to Vulert's playground, you can check for vulnerabilities without needing to install any software.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for pnpm.
