SB2026061551 - Path traversal in pnpm

Description

This security bulletin contains information about 1 vulnerability.

1) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to overwrite files outside the selected download directory.

The vulnerability exists due to path traversal in pnpm stage download when deriving a local filename from registry-controlled package name and version fields. A remote attacker can supply a crafted manifest to overwrite files outside the selected download directory.

User interaction is required to run the stage download command on the crafted package.

Remediation

Install update from vendor's website.

References

• https://github.com/pnpm/pnpm/security/advisories/GHSA-v23m-ccfg-pq9h
• https://github.com/pnpm/pnpm/commit/65443f4bdf1f0db9c8c7dc58fee25252607e9234