CVE-2026-82392highCWE-22

CVE-2026-82392: fallo de gravedad alta en pnpm

pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear pnpm+ Monitorear pnpm

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 7.1epss 0.6%
pnpm is a package manager. Prior to 10.34.5 and from 11.0.0 until 11.11.0, pnpm parses the package name from attacker-controlled pnpm-lock.yaml packages keys with dp.parse(depPath).name and uses it without validation in deps/graph-builder/src/lockfileToDepGraph.ts and pnpm11/deps/graph-builder/src/lockfileToDepGraph.ts. The name reaches path.join(modules, pkgName), storeController.importPackage, and pnpm11/lockfile/to-pnp/src/index.ts, allowing package contents to be written outside node_modules when a user runs pnpm install. When dangerouslyAllowAllBuilds or a matching allowBuilds entry permits lifecycle scripts, the escaped package can execute code with the user's privileges. This issue is fixed in versions 10.34.5 and 11.11.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
Productos afectados
pnpm · pnpm
CVEs relacionadas — pnpm

En el mismo producto, de las más peligrosas a las menos.

CVE-2023-37478HIGHpnpm incorrectly parses tar archives relative to specificationEPSS 1.2%CVE-2025-69262HIGHpnpm vulnerable to Command Injection via environment variable substitutionEPSS 1.0%CVE-2025-69264HIGHpnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default"EPSS 1.0%CVE-2024-53866MEDIUMpnpm vulnerable to no-script global cache poisoning via overrides / `ignore-scripts` evasionEPSS 1.0%CVE-2026-82393HIGHpnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on installEPSS 0.6%CVE-2026-50016HIGHpnpm: Transitive dependency alias path traversal allows project path override via symlink replacementEPSS 0.5%