kmcom-nuxt-layers (>=2.2.0, <=2.2.12) potentially affected by CVE-2026-59196 via pnpm (11.5.3)

pnpm NPM version 11.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on pnpm and may be impacted: - kmcom-nuxt-layers =2.2.0, =2.2.12 Source cves: CVE-2026-59196 Source advisory: SNYK:JS-PNPM-17660537...

kmcom-nuxt-layers (>=2.2.0, <=2.2.12) potentially affected by CVE-2026-59196 via pnpm (11.5.3)

pnpm NPM version 11.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on pnpm and may be impacted: - kmcom-nuxt-layers =2.2.0, =2.2.12 Source cves: CVE-2026-59196 Source advisory: OSV:GHSA-FR4H-3CPH-29XV...

@pnpm/building.commands (>=1100.0.4, <=1100.1.3), @pnpm/deps.compliance.commands (>=1101.1.1, <=1101.3.3) +8 more potentially affected by CVE-2026-59196 via @pnpm/installing.deps-installer (>=1101.0.0, <=1101.8.0)

@pnpm/installing.deps-installer NPM version =1101.0.0, =1100.0.4, =1101.1.1, =1100.1.3, =1101.0.2, =1100.0.4, =1100.0.4, =1100.1.2, =1100.0.4, =1100.2.0, =0.0.2, =0.0.21 Source cves: CVE-2026-59196 Source advisory: SNYK:JS-PNPMINSTALLINGDEPSINSTALLER-17660539...

NPM: pnpm: Hoisted install imports lockfile alias outside node_modules

NPM: pnpm: Hoisted install imports lockfile alias outside nodemodules vulnerability discovered by ? in WordPress Npm pnpm versions 10.34.4...

pnpm: Hoisted install imports lockfile alias outside node_modules

Summary The hoisted dependency alias issue tracked as GHSA-fr4h-3cph-29xv / CAND-PNPM-059 has been addressed in both pnpm and pacquet. A crafted lockfile alias could be joined directly under a hoisted nodemodules directory. Traversal aliases could escape that directory, while reserved aliases suc...

External Control of File Name or Path

Overview pnpm is a Fast, disk space efficient package manager Affected versions of this package are vulnerable to External Control of File Name or Path via the lockfile alias handling process. An attacker can overwrite files or directories outside the intended nodemodules directory by crafting a...

PT-2026-56092

Summary The patch-remove deletion-scope issue tracked as GHSA-72r4-9c5j-mj57 / CAND-PNPM-030 has been addressed in pnpm. A crafted patch entry could resolve outside the configured patches directory and cause pnpm patch-remove to delete an arbitrary reachable file. This patch validates the...

PT-2026-55946

Name of the Vulnerable Software and Affected Versions pnpm versions prior to 10.34.4 pnpm versions prior to 11.7.0 Description A crafted patch entry can resolve outside the configured patches directory, allowing the pnpm patch-remove command to delete an arbitrary reachable file. Recommendations...

PT-2026-56098

Summary The hoisted dependency alias issue tracked as GHSA-fr4h-3cph-29xv / CAND-PNPM-059 has been addressed in both pnpm and pacquet. A crafted lockfile alias could be joined directly under a hoisted node modules directory. Traversal aliases could escape that directory, while reserved aliases su...

PT-2026-56105

Summary pnpm accepts package names from the env lockfile configDependencies section and uses those names directly when creating config dependency symlinks under node modules/.pnpm-config. A malicious repository can commit a crafted pnpm-lock.yaml whose env-lockfile document contains a...

External Control of File Name or Path

Overview @pnpm/releasing.commands is a Commands for deploy, pack, and publish Affected versions of this package are vulnerable to External Control of File Name or Path via the stage download process. An attacker can overwrite arbitrary files outside the intended directory by crafting a manifest...

External Control of File Name or Path

Overview pnpm is a Fast, disk space efficient package manager Affected versions of this package are vulnerable to External Control of File Name or Path via the stage download process. An attacker can overwrite arbitrary files outside the intended directory by crafting a manifest with malicious...

NPM: pnpm: `stage download` writes outside its destination directory via manifest name/version traversal

NPM: pnpm: stage download writes outside its destination directory via manifest name/version traversal vulnerability discovered by ? in WordPress Npm pnpm versions = 11.3.0, 11.5.3...

GHSA-4GXM-V5V7-FQC4 pnpm: Reserved bin name deletes PNPM_HOME during global remove

Maintainer Action Plan Maintainer Action Plan This report is ready to review with the shared patch branch. Start with the PR and the expected fixed behavior, then use the detailed exploit narrative below only if you want to replay the original path. - Advisory: CAND-PNPM-085 / GHSA-4gxm-v5v7-fqc4...

@pnpm/bins.linker (>=1100.0.0, <=1100.0.10), @pnpm/bins.remover (>=1100.0.0, <=1100.0.6) +28 more potentially affected by CVE-2026-55699 via @pnpm/bins.resolver (>=1100.0.0, <=1100.0.5)

@pnpm/bins.resolver NPM version =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.24 and more Source cves: CVE-2026-55699 Source advisory:...

@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +14 more potentially affected by CVE-2026-55699 via pnpm (>=10.0.0, <=10.33.2)

pnpm NPM version =10.0.0, =0.1.0, =1.1.1, =3.7.16, =0.1.0-beta.3, =0.1.0, =0.1.8, =0.1.0, =0.1.0, =2.7.2, =0.0.2, =0.2.5, =0.3.14 and more Source cves: CVE-2026-55699 Source advisory: SNYK:JS-PNPM-17661053...

@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +14 more potentially affected by CVE-2026-55699 via pnpm (>=10.0.0, <=10.33.2)

pnpm NPM version =10.0.0, =0.1.0, =1.1.1, =3.7.16, =0.1.0-beta.3, =0.1.0, =0.1.8, =0.1.0, =0.1.0, =2.7.2, =0.0.2, =0.2.5, =0.3.14 and more Source cves: CVE-2026-55699 Source advisory: OSV:GHSA-4GXM-V5V7-FQC4...

NPM: pnpm: Reserved bin name deletes PNPM_HOME during global remove

NPM: pnpm: Reserved bin name deletes PNPMHOME during global remove vulnerability discovered by ? in WordPress Npm pnpm versions 10.34.2...

EUVD-2026-39485

pnpm: Reserved bin name deletes PNPMHOME during global remove...

External Control of File Name or Path

Overview @pnpm/bins.resolver is a Returns bins of a package Affected versions of this package are vulnerable to External Control of File Name or Path through the handling of reserved or malformed bin names during global package operations. An attacker can cause deletion of critical directories...