pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph (CVE-2026-82392)

pnpm, a package manager, improperly validates package names parsed from pnpm-lock.yaml keys using dp.parse(depPath).name. These unvalidated names are used in path operations (path.join) and package import functions, enabling path traversal that writes package contents outside the intended node_modules directory during pnpm install. When lifecycle scripts are allowed via dangerouslyAllowAllBuilds or matching allowBuilds entries, this can result in execution of attacker-controlled code with the user's privileges. The vulnerability affects versions prior to 10.34.5 and versions from 11.0.0 up to but not including 11.11.0. Fixes were released in versions 10.34.5 and 11.11.0.

An attacker who can control package names in pnpm-lock.yaml can cause arbitrary files to be written outside the node_modules directory during installation. If lifecycle scripts are enabled, this can lead to arbitrary code execution with the privileges of the user running pnpm. The vulnerability does not require privileges and can be triggered remotely via crafted lockfiles. The CVSS score is 7.1 (high severity) with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and low availability impact.

A fix is available in pnpm versions 10.34.5 and 11.11.0. Users should upgrade to these versions or later to remediate this vulnerability. No additional mitigations are indicated by the vendor advisory.