CVE-2026-82392

pnpm, a widely used JavaScript package manager, contains a path traversal flaw (CWE-22): the package name parsed from attacker-controlled entries in pnpm-lock.yaml is used without validation when building the dependency graph, allowing package contents to be written outside node_modules. An attacker who can control a project's pnpm-lock.yaml — for example via a malicious dependency update, a crafted pull request, or a cloned repository — can embed traversal sequences in the package keys so that when a user or CI system runs pnpm install, files are written outside the project's node_modules directory. If the project permits lifecycle scripts via dangerouslyAllowAllBuilds or a matching allowBuilds entry, the escaped package's install scripts can execute arbitrary code with the victim user's privileges; otherwise the impact is limited to arbitrary file writes. All pnpm users on versions prior to 10.34.5 or on 11.0.0 up to (but not including) 11.11.0 are exposed when installing from an untrusted lockfile. No public proof of concept is known, the issue is not in CISA's KEV catalog, and EPSS currently assigns a 0.4% probability of exploitation within 30 days (33rd percentile), so no in-the-wild exploitation has been reported; the CVSS 3.1 score is 7.1 (high).

What to do: Upgrade pnpm to 10.34.5 on the 10.x line or 11.11.0 on the 11.x line (or later). Until upgraded, avoid running pnpm install against lockfiles from untrusted sources and review lockfile changes in pull requests for traversal sequences in the packages keys; keep lifecycle scripts restricted (avoid dangerouslyAllowAllBuilds and scope allowBuilds entries) so an escaped package cannot execute code. Check for unexpected writes outside node_modules following installs performed from untrusted or externally modified lockfiles.