CVE-2026-82392

pnpm is a package manager. Prior to 10.34.5 and from 11.0.0 until 11.11.0, pnpm parses the package name from attacker-controlled pnpm-lock.yaml packages keys with dp.parse(depPath).name and uses it without validation in deps/graph-builder/src/lockfileToDepGraph.ts and pnpm11/deps/graph-builder/src/lockfileToDepGraph.ts. The name reaches path.join(modules, pkgName), storeController.importPackage, and pnpm11/lockfile/to-pnp/src/index.ts, allowing package contents to be written outside node_modules when a user runs pnpm install. When dangerouslyAllowAllBuilds or a matching allowBuilds entry permits lifecycle scripts, the escaped package can execute code with the user's privileges. This issue is fixed in versions 10.34.5 and 11.11.0.

• CWE-22

• https://github.com/pnpm/pnpm/commit/51300fd41c5e4c8f47635108e373cc3d1f324fa7
• https://github.com/pnpm/pnpm/commit/78e29fe5583a1e5d69ea05e414eff310f78d5ed9
• https://github.com/pnpm/pnpm/pull/12872
• https://github.com/pnpm/pnpm/pull/12890
• https://github.com/pnpm/pnpm/releases/tag/v10.34.5
• https://github.com/pnpm/pnpm/releases/tag/v11.11.0
• https://github.com/pnpm/pnpm/security/advisories/GHSA-c59q-g84q-2gj5

Published

Aug 31, 2026

Last Modified

Sep 9, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-82386Improper Restriction of XML External Entity Reference in Apa…7.7
• CVE-2026-82387Improper Neutralization of Input During Web Page Generation …5.4
• CVE-2026-82388bt_hfp_hf_connect() in subsys/bluetooth/host/classic/hfp_hf.…5.3
• CVE-2026-82389In the Bluetooth Classic Hands-Free Profile Audio Gateway ro…6.5
• CVE-2026-8239Concrete CMS 9.5.0 and below is vulnerable to IDOR. The '/cc…5.3
• CVE-2026-82390The Espressif AES driver drivers/crypto/crypto_esp32_aes.c a…3.7
• CVE-2026-82393pnpm is a package manager. Prior to 10.34.5 and 11.11.0, pnp…7.5
• CVE-2026-82394Sulu is an open-source PHP content management system based o…5.3
• CVE-2026-82395Sulu is an open-source PHP content management system based o…5.3
• CVE-2026-82396Sulu is an open-source PHP content management system based o…5.4
• CVE-2026-82397Tornado is a Python web framework and asynchronous networkin…7.5
• CVE-2026-82398pypdf is a free and open-source pure-python PDF library. Pri…5.3