{"id":"CVE-2026-82392","title":"pnpm is a package manager","summary":"pnpm is a package manager. Prior to 10.34.5 and from 11.0.0 until 11.11.0, pnpm parses the package name from attacker-controlled pnpm-lock.yaml packages keys with dp.parse(depPath).name and uses it without validation in deps/graph-builde…","severity":"high","cvss":7.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L","cwe":["CWE-22"],"vendor":"pnpm","product":"pnpm","affected":["pnpm < 10.34.5","pnpm >= 11.0.0, < 11.11.0"],"patched":["pnpm 10.34.5","pnpm 11.11.0"],"published":"2026-08-31","updated":"2026-09-09","sourceUpdated":"2026-09-09T21:09:13.080","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-82392","references":[{"url":"https://github.com/pnpm/pnpm/commit/51300fd41c5e4c8f47635108e373cc3d1f324fa7","label":"security-advisories@github.com"},{"url":"https://github.com/pnpm/pnpm/commit/78e29fe5583a1e5d69ea05e414eff310f78d5ed9","label":"security-advisories@github.com"},{"url":"https://github.com/pnpm/pnpm/pull/12872","label":"security-advisories@github.com"},{"url":"https://github.com/pnpm/pnpm/pull/12890","label":"security-advisories@github.com"},{"url":"https://github.com/pnpm/pnpm/releases/tag/v10.34.5","label":"security-advisories@github.com"},{"url":"https://github.com/pnpm/pnpm/releases/tag/v11.11.0","label":"security-advisories@github.com"},{"url":"https://github.com/pnpm/pnpm/security/advisories/GHSA-c59q-g84q-2gj5","label":"security-advisories@github.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-82392"},{"url":"https://github.com/advisories/GHSA-c59q-g84q-2gj5"}],"tags":["nvd","ghsa","npm"],"epss":0.00397,"epssPercentile":0.33619,"aliases":["GHSA-c59q-g84q-2gj5"],"ecosystem":"npm","ingestedAt":"2026-09-02T14:45:30.140Z","slug":"CVE-2026-82392","body":"## Overview\n\npnpm is a package manager. Prior to 10.34.5 and from 11.0.0 until 11.11.0, pnpm parses the package name from attacker-controlled pnpm-lock.yaml packages keys with dp.parse(depPath).name and uses it without validation in deps/graph-builder/src/lockfileToDepGraph.ts and pnpm11/deps/graph-builder/src/lockfileToDepGraph.ts. The name reaches path.join(modules, pkgName), storeController.importPackage, and pnpm11/lockfile/to-pnp/src/index.ts, allowing package contents to be written outside node_modules when a user runs pnpm install. When dangerouslyAllowAllBuilds or a matching allowBuilds entry permits lifecycle scripts, the escaped package can execute code with the user's privileges. This issue is fixed in versions 10.34.5 and 11.11.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-82392)\n\nAffected packages:\n\n- `pnpm < 10.34.5`\n- `pnpm >= 11.0.0, < 11.11.0`\n\nPatched in:\n\n- `pnpm 10.34.5`\n- `pnpm 11.11.0`\n\nSource: https://github.com/advisories/GHSA-c59q-g84q-2gj5","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":39.1,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}