CVE-2026-23889 pnpm has Windows-specific tarball Path Traversal

pnpm is a package manager. Prior to version 10.28.1, a path traversal vulnerability in pnpm's tarball extraction allows malicious packages to write files outside the package directory on Windows. The path normalization only checks for ./ but not .. On Windows, backslashes are directory separators...

@directus/release-notes-generator (>=2.0.2, <=3.0.0), @eclipse-scout/releng (>=26.2.0, <=26.2.1) +107 more potentially affected by CVE-2026-23889 via @pnpm/store.cafs (>=1000.0.0, <=1000.1.1)

@pnpm/store.cafs NPM version =1000.0.0, =2.0.2, =26.2.0, =0.1.0-beta.0, =4.0.0, =2.0.1, =1000.3.2, =1000.0.0, =1000.0.0, =1000.1.1, =1000.1.0, =1000.0.1, =1000.0.28 and more Source cves: CVE-2026-23889 Source advisory: SNYK:JS-PNPMSTORECAFS-15116159...

@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +10 more potentially affected by CVE-2026-23889 via pnpm (>=10.0.0, <=10.18.3)

pnpm NPM version =10.0.0, =0.1.0, =1.1.1, =3.7.16, =0.1.8, =0.1.0, =2.7.2, =0.2.5, =1.0.4, =1.0.7 Source cves: CVE-2026-23889 Source advisory: OSV:GHSA-6X96-7VC8-CM3P...