A critical path traversal vulnerability in pnpm versions prior to 10.34.5 and 11.11.0 allows for arbitrary file overwriting and potential remote code execution during package installation.

This is a path traversal flaw caused by improper validation of scoped package names in tarball manifests. An unauthenticated attacker can exploit this during the installation process to write files to restricted locations on the filesystem.

Successful exploitation allows an attacker to overwrite critical system files, such as shell configuration files or Git hooks, which leads to arbitrary code execution on the developer machine or build server. Given the CVSS score of 7.5, this high severity vulnerability poses a significant risk to the integrity and availability of development environments and CI/CD pipelines.

Immediate Action: Update pnpm to version 10.34.5 or 11.11.0 immediately to include the necessary validation logic for scoped package names.

Proactive Monitoring: Review build logs for unexpected file write operations or attempts to access directories outside of the project root during the dependency resolution phase.

Compensating Controls: Execute package installations within isolated, ephemeral containers or sandboxed environments with restricted filesystem permissions to limit the impact of potential overwrites.

Public Exploit Available: No

Organizations relying on pnpm for dependency management must prioritize updating to the patched versions. Because this vulnerability can be triggered during standard package installation, the risk of supply chain compromise is high, necessitating immediate action to secure development and build environments.