pnpm: `stage download` writes outside its destination directory via manifest name/version traversal
Date: 2026-06
Affected: npm/pnpm
Attack vector: supply-chain
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-55700
CWE: CWE-22
CWE-73
CVSS: 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L)

## Summary The staged-tarball filename traversal reported as GHSA-v23m-ccfg-pq9h / CAND-PNPM-038 is fixed on `main` by [pnpm/pnpm#12303](https://github.com/pnpm/pnpm/pull/12303), merged as `65443f4bdf1f0db9c8c7dc58fee25252607e9234`. Before the fix, `pnpm stage download` derived a local filename from registry-controlled package name and version fields. A crafted manifest could escape the selected download directory and overwrite another reachable file. The merged fix validates both fields, derives one safe filename, and verifies the final destination before writing. ## Security boundary - Package names and semantic versions are validated before they can influence a local filename. - POSIX and Windows path separators are rejected by basename checks. - Stage download and tarball summary paths use the same filename helper. - The resolved output path must remain an immediate child of the selected download directory. - The stage identifier is already constrained to a UUID. ## Exploit replay Before `65443f4bdf`, a traversal-bearing manifest version could make the command write outside the selected directory. After the fix, malicious package names fail with `ERR_PNPM_INVALID_PACKAGE_NAME`, malicious versions fail with `ERR_PNPM_INVALID_PACKAGE_VERSION`, no outside file is created, and the download directory remains empty. ## Files changed - `releasing/commands/src/tarball/safeTarballFilename.ts` validates manifest identity and rejects cross-platform path separators. - `releas


Mitigations:

Architectural layers (MAESTRO):