Two High-Severity pnpm CVEs Turn Install Into Arbitrary File Write

Two high-severity CVEs just landed against the same MCP server, and both of them turn pnpm install into a weapon. If you run Arcmira, stop and read this before your next dependency update.

Both advisories trace back to how pnpm's installer decides where to write files on disk. Get that logic wrong, and a malicious lockfile or package can write outside node_modules entirely — onto your .zshrc, your .git/hooks, anywhere the process has permission to touch.

CVE-2026-82392 — Lockfile path traversal in the virtual store linker

The virtual store linker builds install directories with path.join(modules, pkgName), where pkgName comes straight from a lockfile packages key — no validation. Slip a traversal sequence into that key (../../../tmp/pwned@1.0.0), and pnpm happily writes package contents to that path during install.

What makes this one sting is that it's a second attempt. It's an incomplete fix of an earlier advisory (GHSA-fr4h-3cph-29xv) — the previous patch, safeJoinModulesDir, didn't fully contain the traversal. If you patched the first time and moved on, you're not covered.

CVE-2026-82393 — Tarball manifest name escapes node_modules

This one hides in the package manifest instead of the lockfile. pnpm uses a resolved package's name field as a raw path segment when linking it into place. A tarball dependency whose package.json declares a scoped traversal name (@x/../../../…/<absolute path>) gets extracted outside node_modules — to a path the attacker chooses.

That means arbitrary file overwrite, not just write. Attacker-controlled destination, filename, and contents adds up to code execution — overwrite a shell rc file or a git hook and the next command you run does their bidding.

What to actually do

• Update pnpm now. Both CVEs are installer-level bugs, not application bugs — the fix has to come from a patched pnpm release, not from Arcmira's own code.
• Don't trust lockfiles from outside your org. Since CVE-2026-82392 is an incomplete fix of a prior advisory, treat any pnpm-lock.yaml from an unfamiliar fork or PR as untrusted input until you've confirmed your pnpm version is current.
• Audit tarball dependencies. CVE-2026-82393 specifically targets tarball-resolved packages rather than registry ones — if your install pulls from tarball URLs, that's your highest-risk path.
• Check what already landed. If you installed Arcmira dependencies recently on a vulnerable pnpm version, look for unexpected files outside node_modules before assuming you're clean.

Installers are supposed to be the boring, trusted part of the stack. When the boring part starts writing files wherever attacker-controlled strings point, "boring" is exactly the assumption you can't afford anymore.