Is CVE-2026-82392 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-82392 being exploited in the wild.

How severe is CVE-2026-82392?

High severity, with a CVSS score of 7.1, published 31 August 2026.

Which products and versions are affected?

pnpm (npm) SEMVER:introduced=0,fixed=10.34.5.

Is there a fix for CVE-2026-82392?

Yes. pnpm (npm): upgrade to 10.34.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-82392 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-82392?

Check whether you run pnpm (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-82392: pnpm virtual store linker path traversal via unvalidated depPath

CVE-2026-82392 · Severity: high · CVSS 7.1 · Published 2026-08-31

pnpm is a package manager that installs JavaScript dependencies. A crafted lockfile (pnpm-lock.yaml) can cause pnpm to write package files to arbitrary locations on a user's filesystem instead of the intended dependency folder when running `pnpm install`. An attacker who commits a malicious lockfile to a repository can compromise any developer or system that installs dependencies, leading to file overwrites in sensitive locations like git hooks (enabling code execution) or binary directories.

Technologies: pnpm (npm). Vendors: npm.

Quick answers

Is CVE-2026-82392 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-82392 being exploited in the wild.
How severe is CVE-2026-82392?: High severity, with a CVSS score of 7.1, published 31 August 2026.
Which products and versions are affected?: pnpm (npm) SEMVER:introduced=0,fixed=10.34.5.
Is there a fix for CVE-2026-82392?: Yes. pnpm (npm): upgrade to 10.34.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-82392 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-82392?: Check whether you run pnpm (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pnpm (npm): upgrade to 10.34.5 or later
```
npm install pnpm@10.34.5
```

Technical details

This is a path traversal vulnerability (CWE-22) in pnpm's lockfile parsing and package installation flow. The vulnerable code extracts package names from lockfile `packages` keys using `dp.parse(depPath).name` without validation; a depPath like `../../../tmp/pwned@1.0.0` yields a name of `../../../tmp/pwned`. This unvalidated name is then passed to `path.join(modules, pkgName)` in `lockfileToDepGraph.ts:233`, allowing the resolved path to escape the virtual store and point to arbitrary locations (e.g., `/tmp/pwned`). The package content is subsequently written to this traversed path via `storeController.importPackage()`. Attack requires the victim to run `pnpm install` on a repository containing a crafted lockfile—user interaction is required but typical for development workflows. No authentication is needed. The same flaw affects the PnP linker configuration and can escalate to RCE if `dangerouslyAllowAllBuilds: true` is set, allowing postinstall scripts to execute at the traversed path. Patches are available in versions 10.34.5 and 11.11.0.

Affected products

pnpm pnpm < 10.34.5, >= 11.0.0 < 11.11.0

Identifiers

CVE-2026-82392
GHSA-c59q-g84q-2gj5

Timeline

2026-09-02: disclosed: GitHub Security Advisory GHSA-c59q-g84q-2gj5 published
2026: patched: Fixed in pnpm 10.34.5 and 11.11.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.