| Package | Affected versions | Patched versions |
|---|---|---|
| pnpm | ≥ 11.3.0, < 11.5.3 | 11.5.3 |
| pnpm | ≥ 11.3.0, < 11.5.3 | 11.5.3 |
The staged-tarball filename traversal reported as GHSA-v23m-ccfg-pq9h / CAND-PNPM-038 is fixed on main by pnpm/pnpm#12303, merged as 65443f4bdf1f0db9c8c7dc58fee25252607e9234.
Before the fix, pnpm stage download derived a local filename from registry-controlled package name and version fields. A crafted manifest could escape the selected download directory and overwrite another reachable file. The merged fix validates both fields, derives one safe filename, and verifies the final destination before writing.
Before 65443f4bdf, a traversal-bearing manifest version could make the command write outside the selected directory. After the fix, malicious package names fail with ERR_PNPM_INVALID_PACKAGE_NAME, malicious versions fail with ERR_PNPM_INVALID_PACKAGE_VERSION, no outside file is created, and the download directory remains empty.
releasing/commands/src/tarball/safeTarballFilename.ts validates manifest identity and rejects cross-platform path separators.releasing/commands/src/stage/download.ts verifies the resolved destination before writing.releasing/commands/src/tarball/summarizeTarball.ts uses the same filename contract.releasing/commands/test/stage.test.ts covers traversal through both package name and version..changeset/stale-stage-tarballs.md includes patch bumps for @pnpm/releasing.commands and pnpm.65443f4bdf1f0db9c8c7dc58fee25252607e9234Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free$ git diff --check 65443f4bdf^ 65443f4bdf
PASS
$ gh pr view 12303 --repo pnpm/pnpm --json state,mergeCommit,statusCheckRollup
MERGED as 65443f4bdf
pnpm/test/dlx.ts cache test after 512 other tests passed. The PR was merged by the maintainer; the failure did not involve the staging code.git diff --check also passed.Staging and release commands are TypeScript-only. Pacquet does not expose this command family, so no Rust-side port is required.
The final fs.writeFile follows a pre-existing symlink at the exact in-directory output name. That requires separate local filesystem access and is not controllable through the registry manifest traversal described here.
Written by an agent (Codex, GPT-5).