Directory Traversal

Overview @pnpm/package-bins is a that returns bins of a package. Affected versions of this package are vulnerable to Directory Traversal via the getBinsFromPackageManifest function. An attacker can modify file permissions outside the intended directory by supplying a crafted value in the...

@directus/release-notes-generator (>=2.0.2, <=3.0.0), @eclipse-scout/releng (>=26.2.0, <=26.2.1) +78 more potentially affected by CVE-2026-24131 via @pnpm/package-bins (>=1000.0.0, <=1000.0.16)

@pnpm/package-bins NPM version =1000.0.0, =2.0.2, =26.2.0, =0.1.0-beta.0, =1000.3.2, =1000.0.21, =1000.1.1, =1000.0.0, =1007.0.1, =1002.2.0, =1002.3.0 - @pnpm/deps.compliance.commands 1000.0.0 and more Source cves: CVE-2026-24131 Source advisory: SNYK:JS-PNPMPACKAGEBINS-15102727...

@directus/release-notes-generator (>=2.0.2, <=3.0.0), @eclipse-scout/releng (>=26.2.0, <=26.2.1) +78 more potentially affected by CVE-2026-23890 via @pnpm/package-bins (>=1000.0.0, <=1000.0.15)

@pnpm/package-bins NPM version =1000.0.0, =2.0.2, =26.2.0, =0.1.0-beta.0, =1000.3.2, =1000.0.21, =1000.1.1, =1000.0.0, =1007.0.1, =1002.2.0, =1002.2.23 - @pnpm/deps.compliance.commands 1000.0.0 and more Source cves: CVE-2026-23890 Source advisory: SNYK:JS-PNPMPACKAGEBINS-15103738...

Relative Path Traversal

Overview @pnpm/package-bins is a that returns bins of a package. Affected versions of this package are vulnerable to Relative Path Traversal via the commandsFromBin function when performing bin name validation and normalization. An attacker can create or overwrite arbitrary files outside the...

@pnpm/headless (>=8.0.0, <=10.0.4), @pnpm/modules-cleaner (>=5.0.0, <=7.0.3) +4 more potentially affected by CVE-2019-10773 via @pnpm/package-bins (4.0.0)

@pnpm/package-bins NPM version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @pnpm/package-bins and may be impacted: - @pnpm/headless =8.0.0, =5.0.0, =0.1.0, =0.1.0, =0.1.0, =0.35.0, =0.36.6 Source cves: CVE-2019-10773 Source advisory:...