CVE-2026-82392

pnpm is a package manager. Prior to 10.34.5 and from 11.0.0 until 11.11.0, pnpm parses the package name from attacker-controlled pnpm-lock.yaml packages keys with dp.parse(depPath).name and uses it without validation in deps/graph-builder/src/lockfileToDepGraph.ts and pnpm11/deps/graph-builder/src/lockfileToDepGraph.ts. The name reaches path.join(modules, pkgName), storeController.importPackage, and pnpm11/lockfile/to-pnp/src/index.ts, allowing package contents to be written outside node_modules when a user runs pnpm install. When dangerouslyAllowAllBuilds or a matching allowBuilds entry permits lifecycle scripts, the escaped package can execute code with the user's privileges. This issue is fixed in versions 10.34.5 and 11.11.0.

• CWE-22

• https://github.com/pnpm/pnpm/commit/51300fd41c5e4c8f47635108e373cc3d1f324fa7
• https://github.com/pnpm/pnpm/commit/78e29fe5583a1e5d69ea05e414eff310f78d5ed9
• https://github.com/pnpm/pnpm/pull/12872
• https://github.com/pnpm/pnpm/pull/12890
• https://github.com/pnpm/pnpm/releases/tag/v10.34.5
• https://github.com/pnpm/pnpm/releases/tag/v11.11.0
• https://github.com/pnpm/pnpm/security/advisories/GHSA-c59q-g84q-2gj5

Published

Aug 31, 2026

Last Modified

Sep 1, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-8236Concrete CMS 9.5.0 and below is vulnerable to IDOR combined …4.3
• CVE-2026-82364A security vulnerability has been detected in macrozheng mal…4.2
• CVE-2026-82367Exposure of Data Element to Wrong Session vulnerability in a…2.3
• CVE-2026-8237Concrete CMS 9.5.0 and below is vulnerable to IDOR. The `/cc…5.3
• CVE-2026-8238Concrete CMS 9.5.0 and below is vulnerable to IDOR. The '/cc…5.3
• CVE-2026-8239Concrete CMS 9.5.0 and below is vulnerable to IDOR. The '/cc…5.3
• CVE-2026-82393pnpm is a package manager. Prior to 10.34.5 and 11.11.0, pnp…7.5
• CVE-2026-82394Sulu is an open-source PHP content management system based o…5.3
• CVE-2026-82395Sulu is an open-source PHP content management system based o…5.3
• CVE-2026-82396Sulu is an open-source PHP content management system based o…5.4
• CVE-2026-82397Tornado is a Python web framework and asynchronous networkin…7.5
• CVE-2026-82398pypdf is a free and open-source pure-python PDF library. Pri…6.9