Bug 2526555 (CVE-2026-82392)

Summary: CVE-2026-82392 pnpm: pnpm: Arbitrary Code Execution via Path Traversal
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: anujha, aschwart, asoldano, aszczucz, ataylor, bbaranow, bmaxwell, boliveir, bstansbe, csuconic, dbruscin, dlofthou, drichtar, ehugonne, gbenhaim, gtully, istudens, ivassile, iweiss, jsherman, kvanderr, mosmerov, mposolda, msvehla, niyer, nwallace, pberan, pesilva, pjindal, pmackay, rgemmell, rgodfrey, rmartinc, rstancel, ssilvert, sthorger, tbish, thjenkin, tlavocat, twaugh, vdosoudi, vmuzikar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in pnpm, a package manager. An attacker can craft a malicious `pnpm-lock.yaml` file that, when processed by a user running `pnpm install`, allows package contents to be written outside the intended `node_modules` directory. If the system is configured to allow lifecycle scripts, this path traversal vulnerability can lead to arbitrary code execution with the user's privileges.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-08-31 21:11:20 UTC 
pnpm is a package manager. Prior to 10.34.5 and from 11.0.0 until 11.11.0, pnpm parses the package name from attacker-controlled pnpm-lock.yaml packages keys with dp.parse(depPath).name and uses it without validation in deps/graph-builder/src/lockfileToDepGraph.ts and pnpm11/deps/graph-builder/src/lockfileToDepGraph.ts. The name reaches path.join(modules, pkgName), storeController.importPackage, and pnpm11/lockfile/to-pnp/src/index.ts, allowing package contents to be written outside node_modules when a user runs pnpm install. When dangerouslyAllowAllBuilds or a matching allowBuilds entry permits lifecycle scripts, the escaped package can execute code with the user's privileges. This issue is fixed in versions 10.34.5 and 11.11.0.