CVE-2026-82392: pnpm Path Traversal Vulnerability in Virtual Store Linker
Summary
CVE-2026-82392: pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph. Affects pnpm across 2 version ranges.
< 10.34.5
>= 11.0.0, < 11.11.0
Fixed in 10.34.5 or 11.11.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
pnpm is a fast, disk space-efficient package manager for Node.js that utilizes a unique approach to package installation by creating a virtual store. This method allows for efficient management of dependencies, reducing duplication and improving installation speed. However, pnpm is susceptible to a path traversal vulnerability that can lead to arbitrary file writes on the filesystem, posing significant security risks.
Vulnerability Detail
The vulnerability arises from the virtual store linker's construction of package installation directories using unvalidated package names extracted from the pnpm-lock.yaml file. Specifically, the package name is derived from the dependency path without any validation, allowing an attacker to craft a malicious lockfile that includes traversal sequences. This can lead to package content being written to arbitrary locations on the filesystem during the installation process, potentially compromising system integrity and security.
How To Fix
Latest published version: 12.15.0 as of 23 Oct 2026
npm install pnpm@12.15.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 10.34.510.34.5npm install pnpm@10.34.5 -
>= 11.0.0, < 11.11.011.11.0npm install pnpm@11.11.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid using crafted pnpm-lock.yaml files from untrusted sources. Additionally, you can implement validation checks on the dependency paths before processing them in your application.
Conclusion
The pnpm path traversal vulnerability (CVE-2026-82392) poses significant risks by allowing attackers to manipulate package installations. It is crucial for users to update to the latest patched versions of pnpm and to be cautious with dependency management to mitigate potential threats.
See every vulnerability recorded for pnpm →
FAQ
The vulnerability allows for path traversal, enabling attackers to write files to arbitrary locations on the filesystem during the installation of packages.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By checking your package-lock.json file with Vulert's playground, you can determine if your application is affected.
An attacker could exploit this vulnerability to overwrite critical files, inject malicious code, or hijack binaries, leading to severe security breaches.
Yes, if the configuration allows it, an attacker could escalate the attack to remote code execution by executing malicious scripts during the installation process.
If immediate updates are not possible, ensure that you do not use untrusted pnpm-lock.yaml files and consider implementing additional validation checks on dependency paths.
References
Related vulnerabilities
Recent vulnerabilities recorded for pnpm.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
