THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-c59q-g84q-2gj5 (high) — pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph

[GHSA] GHSA-c59q-g84q-2gj5 (high) — pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph

medgithub_advisoriesPublished 2026-09-02

GHSA-c59q-g84q-2gj5 Severity: high CVE: CVE-2026-82392

pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph

## Summary

The virtual store linker constructs package installation directories using `path.join(modules, pkgName)` where `pkgName` is extracted from lockfile `packages` keys via `dp.parse(depPath).name` without validation. A crafted `pnpm-lock.yaml

MITRE ATT&CK techniques

Written ContentT1683.001
Malicious PackageAML.T0011.001

Indicators of compromise

CVE-2026-82392cve

Original source: https://github.com/advisories/GHSA-c59q-g84q-2gj5