CVE-2026-82392

Name of the Vulnerable Software and Affected Versions pnpm versions prior to 10.34.5 pnpm versions 11.0.0 through 11.10.0

Description pnpm improperly parses package names from the pnpm-lock.yaml file using the dp.parse(depPath).name function without sufficient validation. This occurs within deps/graph-builder/src/lockfileToDepGraph.ts and pnpm11/deps/graph-builder/src/lockfileToDepGraph.ts. The unvalidated name is passed to path.join(modules, pkgName), storeController.importPackage, and pnpm11/lockfile/to-pnp/src/index.ts, which allows an attacker to write package contents outside the node modules directory during a pnpm install operation. If the dangerouslyAllowAllBuilds setting is enabled or a matching allowBuilds entry permits lifecycle scripts, the escaped package can execute arbitrary code with the privileges of the user.

Recommendations Update to version 10.34.5 or later. Update to version 11.11.0 or later.