@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +14 more potentially affected by CVE-2026-50014 via pnpm (>=10.0.0, <=10.33.2)

pnpm NPM version =10.0.0, =0.1.0, =1.1.1, =3.7.16, =0.1.0-beta.3, =0.1.0, =0.1.8, =0.1.0, =0.1.0, =2.7.2, =0.0.2, =0.2.5, =0.3.14 and more Source cves: CVE-2026-50014 Source advisory: SNYK:JS-PNPM-17667933...

@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +14 more potentially affected by CVE-2026-50014 via pnpm (>=10.0.0, <=10.33.2)

pnpm NPM version =10.0.0, =0.1.0, =1.1.1, =3.7.16, =0.1.0-beta.3, =0.1.0, =0.1.8, =0.1.0, =0.1.0, =2.7.2, =0.0.2, =0.2.5, =0.3.14 and more Source cves: CVE-2026-50014 Source advisory: OSV:GHSA-P4XF-RF54-RJ3X...

CVE-2026-50014

Summary: CVE-2026-50014 affects pnpm prior to 10.34.0 and 11.4.0. The lockfile-controlled git resolution.commit value is passed to git fetch without a separator or commit-format validation, enabling a malicious lockfile to inject git options (notably --upload-pack) in shallow-fetch paths. This ca...