CVE-2026-82392

pnpm , a JavaScript package manager, is affected by a path traversal vulnerability in its virtual store linker. Prior to 10.34.5 and from 11.0.0 until 11.11.0 , pnpm parses the package name from attacker-controlled pnpm-lock.yaml keys via dp.parse(depPath).name without validation in lockfileToDep...