CVE-2026-82392: pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph
The virtual store linker constructs package installation directories using path.join(modules, pkgName) where pkgName is extracted from lockfile packages keys via dp.parse(depPath).name without validation. A crafted pnpm-lock.yaml with traversal sequences in depPath keys (e.g., ../../../tmp/pwned@1.0.0) causes package content to be written to arbitrary filesystem paths during pnpm install.
This is an incomplete fix of GHSA-fr4h-3cph-29xv — the safeJoinModulesDir containment helper was applied to the hoisted linker and symlinkDependency but NOT to the virtual store linker’s lockfileToDepGraph.ts:233.
References
- github.com/advisories/GHSA-c59q-g84q-2gj5
- github.com/pnpm/pnpm/commit/51300fd41c5e4c8f47635108e373cc3d1f324fa7
- github.com/pnpm/pnpm/commit/78e29fe5583a1e5d69ea05e414eff310f78d5ed9
- github.com/pnpm/pnpm/pull/12872
- github.com/pnpm/pnpm/pull/12890
- github.com/pnpm/pnpm/releases/tag/v10.34.5
- github.com/pnpm/pnpm/releases/tag/v11.11.0
- github.com/pnpm/pnpm/security/advisories/GHSA-c59q-g84q-2gj5
- nvd.nist.gov/vuln/detail/CVE-2026-82392
Code Behaviors & Features
Detect and mitigate CVE-2026-82392 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →