Package Manager Vulnerability in pnpm by PNPM
CVE-2026-82392

7.1HIGH

Key Information:

Vendor

Pnpm

Status
Pnpm
Vendor
CVE Published:
31 August 2026

What is CVE-2026-82392?

The pnpm package manager, versions before 10.34.5 and from 11.0.0 to 11.11.0, contains a security flaw where it improperly handles package names from attacker-controlled pnpm-lock.yaml files. The lack of validation allows these names to reach sensitive file paths, enabling code execution with user privileges, particularly when lifecycle scripts are allowed. This vulnerability has been addressed in the latest versions.

Affected Version(s)

pnpm < 10.34.5 < 10.34.5

pnpm >= 11.0.0, < 11.11.0 < 11.0.0, 11.11.0

References

https://github.com/pnpm/pnpm/security/advisories/GHSA-c59...
x_refsource_CONFIRM
https://github.com/pnpm/pnpm/pull/12872
x_refsource_MISC
https://github.com/pnpm/pnpm/pull/12890
x_refsource_MISC

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.