CVE-2026-82392

Received Received - Intake

Path Traversal in pnpm Package Manager

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: GitHub, Inc.

Description

pnpm is a package manager. Prior to 10.34.5 and from 11.0.0 until 11.11.0, pnpm parses the package name from attacker-controlled pnpm-lock.yaml packages keys with dp.parse(depPath).name and uses it without validation in deps/graph-builder/src/lockfileToDepGraph.ts and pnpm11/deps/graph-builder/src/lockfileToDepGraph.ts. The name reaches path.join(modules, pkgName), storeController.importPackage, and pnpm11/lockfile/to-pnp/src/index.ts, allowing package contents to be written outside node_modules when a user runs pnpm install. When dangerouslyAllowAllBuilds or a matching allowBuilds entry permits lifecycle scripts, the escaped package can execute code with the user's privileges. This issue is fixed in versions 10.34.5 and 11.11.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-31

Last Modified

2026-08-31

Generated

2026-09-01

AI Q&A

2026-09-01

EPSS Evaluated

N/A

NVD

CVE-2026-82392

Affected Vendors & Products

Vendor	Product	Version / Range
pnpm	pnpm	to 10.34.5 (exc)
pnpm	pnpm	From 11.0.0 (inc) to 11.11.0 (inc)
pnpm	pnpm	to 11.11.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability in pnpm allows an attacker to control the package name in pnpm-lock.yaml files. When pnpm processes these names without validation, it can write package contents outside the intended node_modules directory. This happens because the name is used in path operations like path.join(modules, pkgName). If lifecycle scripts are permitted, the escaped package could execute malicious code with the user's privileges.

Detection Guidance

Check pnpm version with pnpm --version. If using versions between 11.0.0 and 11.11.0 or below 10.34.5, the system is vulnerable. Inspect pnpm-lock.yaml for malformed package keys that could indicate exploitation attempts.

Impact Analysis

If you use affected pnpm versions (10.0.0 to 10.34.4 or 11.0.0 to 11.11.0), an attacker could trick you into installing a malicious package. This could lead to arbitrary code execution on your system, data theft, or system compromise. The impact depends on your system permissions and whether lifecycle scripts are enabled.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially violating data protection requirements under GDPR or HIPAA. If exploited, it may result in data breaches, unauthorized access to sensitive data, or failure to maintain system integrity, which are critical compliance concerns.

Mitigation Strategies

Upgrade pnpm to version 10.34.5 or 11.11.0 or later immediately. Review pnpm-lock.yaml for suspicious entries and remove any untrusted packages. Avoid running pnpm install on untrusted lockfiles.

Hi! I’m here to help you understand CVE-2026-82392. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70