CVE-2026-82393

pnpm is a package manager. Prior to 10.34.5 and 11.11.0, pnpm accepts a scoped path traversal in a tarball dependency's package.json manifest name because pnpm11/resolving/npm-resolver/src/pickPackage.ts rejects slash characters only for unscoped names. During pnpm install, the unvalidated name reaches raw path joins in pnpm11/installing/deps-resolver/src/resolvePeers.ts, pnpm11/installing/deps-resolver/src/index.ts, and pnpm11/deps/graph-builder/src/lockfileToDepGraph.ts, causing package extraction outside node_modules and allowing attacker-controlled files to overwrite arbitrary filesystem paths even when --ignore-scripts is used. The overwrite can replace shell startup files, Git hooks, or installed package code and lead to code execution. This issue is fixed in versions 10.34.5, and 11.11.0.

• CWE-22
• CWE-73
• CWE-94

• https://github.com/pnpm/pnpm/commit/51300fd41c5e4c8f47635108e373cc3d1f324fa7
• https://github.com/pnpm/pnpm/commit/78e29fe5583a1e5d69ea05e414eff310f78d5ed9
• https://github.com/pnpm/pnpm/pull/12872
• https://github.com/pnpm/pnpm/pull/12890
• https://github.com/pnpm/pnpm/releases/tag/v10.34.5
• https://github.com/pnpm/pnpm/releases/tag/v11.11.0
• https://github.com/pnpm/pnpm/security/advisories/GHSA-vq4v-j7r6-jq4m
• https://github.com/pnpm/pnpm/security/advisories/GHSA-vq4v-j7r6-jq4m

Published

Aug 31, 2026

Last Modified

Sep 2, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-82364A security vulnerability has been detected in macrozheng mal…4.2
• CVE-2026-82367Exposure of Data Element to Wrong Session vulnerability in a…2.3
• CVE-2026-8237Concrete CMS 9.5.0 and below is vulnerable to IDOR. The `/cc…5.3
• CVE-2026-8238Concrete CMS 9.5.0 and below is vulnerable to IDOR. The '/cc…5.3
• CVE-2026-8239Concrete CMS 9.5.0 and below is vulnerable to IDOR. The '/cc…5.3
• CVE-2026-82392pnpm is a package manager. Prior to 10.34.5 and from 11.0.0 …7.1
• CVE-2026-82394Sulu is an open-source PHP content management system based o…5.3
• CVE-2026-82395Sulu is an open-source PHP content management system based o…5.3
• CVE-2026-82396Sulu is an open-source PHP content management system based o…5.4
• CVE-2026-82397Tornado is a Python web framework and asynchronous networkin…7.5
• CVE-2026-82398pypdf is a free and open-source pure-python PDF library. Pri…6.9
• CVE-2026-8240Concrete CMS 9.5.0 and below is vulnerable to unauthenticate…5.3