@directus/release-notes-generator (>=2.0.2, <=3.0.0), @eclipse-scout/releng (>=26.2.0, <=26.2.1) +78 more potentially affected by CVE-2026-23890 via @pnpm/package-bins (>=1000.0.0, <=1000.0.15)

@pnpm/package-bins NPM version =1000.0.0, =2.0.2, =26.2.0, =0.1.0-beta.0, =1000.3.2, =1000.0.21, =1000.1.1, =1000.0.0, =1007.0.1, =1002.2.0, =1002.2.23 - @pnpm/deps.compliance.commands 1000.0.0 and more Source cves: CVE-2026-23890 Source advisory: SNYK:JS-PNPMPACKAGEBINS-15103738...

Relative Path Traversal

Overview @pnpm/package-bins is a that returns bins of a package. Affected versions of this package are vulnerable to Relative Path Traversal via the commandsFromBin function when performing bin name validation and normalization. An attacker can create or overwrite arbitrary files outside the...