CVE-2026-82392 pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph
Attackers can write files outside node_modules via malicious lockfiles, potentially executing code if build scripts are enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-82392?
CVE-2026-82392 is a high-severity path traversal vulnerability in pnpm, published on 31 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
pnpm is a package manager. Prior to 10.34.5 and from 11.0.0 until 11.11.0, pnpm parses the package name from attacker-controlled pnpm-lock.yaml packages keys with dp.parse(depPath).name and uses it without validation in deps/graph-builder/src/lockfileToDepGraph.ts and pnpm11/deps/graph-builder/src/lockfileToDepGraph.ts. The name reaches path.join(modules, pkgName), storeController.importPackage, and pnpm11/lockfile/to-pnp/src/index.ts, allowing package contents to be written outside node_modules when a user runs pnpm install. When dangerouslyAllowAllBuilds or a matching allowBuilds entry permits lifecycle scripts, the escaped package can execute code with the user's privileges. This issue is fixed in versions 10.34.5 and 11.11.0.
Weakness: CWE-22
Which versions are affected by CVE-2026-82392?
4 open source packages ship an affected version, including pnpm.
| Package | Affected | Fixed in |
|---|---|---|
pnpm npm | All versions | 10.34.5 |
pnpm npm | All versions | 10.34.5 |
pnpm npm | From 11.0.0 | 11.11.0 |
pnpm npm | From 11.0.0 | 11.11.0 |
How do I fix CVE-2026-82392?
Upgrade pnpm to a fixed version for your release line: 10.34.5 or 11.11.0.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-82392 being exploited?
There is no known exploitation of CVE-2026-82392 in the wild and no public exploit code.
Sources
Also known as GHSA-c59q-g84q-2gj5, MINI-q5hw-43wp-pc9v.