Path traversal in pnpm - #VU134553

Detailed vulnerability description

The vulnerability allows a remote attacker to delete files or directories outside the global bin directory.

The vulnerability exists due to path traversal in pnpm global add/remove bin cleanup when processing manifest-derived bin names during global package operations. A remote attacker can install a specially crafted package with reserved bin names to delete files or directories outside the global bin directory.

User interaction is required because the malicious package must be installed globally before a later global remove, update, or add-replacement flow triggers the deletion sink.

Remediation

Sources

• https://github.com/pnpm/pnpm/security/advisories/GHSA-4gxm-v5v7-fqc4
• https://github.com/pnpm/pnpm-ghsa-j2hc-m6cf-6jm8/pull/1