CVE-2026-823927.1HighCWE-22

CVE-2026-82392: pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph

pnpm

Affected: pnpm · Exploitation: unlikely (under 1%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

0.6%probability of exploitation in the next 30 days

50th percentile

050100

Higher than 50% of scored CVEs

7.1HighCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

pnpm is a package manager. Prior to 10.34.5 and from 11.0.0 until 11.11.0, pnpm parses the package name from attacker-controlled pnpm-lock.yaml packages keys with dp.parse(depPath).name and uses it without validation in deps/graph-builder/src/lockfileToDepGraph.ts and pnpm11/deps/graph-builder/src/lockfileToDepGraph.ts. The name reaches path.join(modules, pkgName), storeController.importPackage, and pnpm11/lockfile/to-pnp/src/index.ts, allowing package contents to be written outside node_modules when a user runs pnpm install. When dangerouslyAllowAllBuilds or a matching allowBuilds entry permits lifecycle scripts, the escaped package can execute code with the user's privileges. This issue is fixed in versions 10.34.5 and 11.11.0.

Affected products1

From the CVE record. A product or version that is not listed is unknown, not unaffected.

pnpm · pnpm< 10.34.5; >= 11.0.0, < 11.11.0

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Unlikely (under 1%). EPSS under 1%, or no score yet.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Path Traversal · File and Path Handling
Vendor: pnpm
Published: August 2026
Band: Unlikely (under 1%), August 2026

CoverageNo articles yet

No CyberSIXT article names CVE-2026-82392 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.