PT-2026-53542

Executive Summary: The path validation has a critical logic bug: it checks for .. AFTER normpath has already collapsed all .. sequences. This makes the check completely useless and allows trivial path traversal to any file on the system. The path validation function also does not resolve the...

XFinder

XFinder External Attack Surface Management EASM — a l...

CVE-2026-10646

Zephyr's BSD-sockets getaddrinfo implementation subsys/net/lib/sockets/getaddrinfo.c passes a pointer to a stack-allocated state object struct getaddrinfostate aistate as the userdata of an asynchronous DNS resolver query. The socket layer waits on a semaphore with a timeout deliberately set...

Improper Link Resolution Before File Access

gogs.io/gogs is vulnerable to Improper Link Resolution Before File Access. The vulnerability is due to improper validation of symbolic links in the UploadRepoFiles function, which only checks the final upload target instead of every path component, allowing an attacker with repository write acces...

@pnpm/building.commands (>=1100.0.0, <=1100.1.3), @pnpm/deps.compliance.commands (>=1100.0.0, <=1101.3.3) +10 more potentially affected by CVE-2026-59196 via @pnpm/installing.deps-resolver (>=1100.0.0, <=1100.2.1)

@pnpm/installing.deps-resolver NPM version =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =0.0.1, =0.0.21 Source cves: CVE-2026-59196 Source advisory: SNYK:JS-PNPMINSTALLINGDEPSRESOLVER-17660540...

GHSA-W466-C33R-3GJP pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes

Maintainer Action Plan This report is ready to review with the shared patch branch. Start with the PR and the expected fixed behavior, then use the detailed exploit narrative below only if you want to replay the original path. - Advisory: CAND-PNPM-063 / GHSA-w466-c33r-3gjp - Advisory URL:...

NPM: pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes

NPM: pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes vulnerability discovered by ? in WordPress Npm pnpm versions 10.34.2...

Unsafe Dependency Resolution

Overview @pnpm/building.policy is a Create a function for filtering out dependencies that are not allowed to be built Affected versions of this package are vulnerable to Unsafe Dependency Resolution via the approval process for dependency sources. An attacker can execute unauthorized code during...

Unsafe Dependency Resolution

Overview pnpm is a Fast, disk space efficient package manager Affected versions of this package are vulnerable to Unsafe Dependency Resolution via the approval process for dependency sources. An attacker can execute unauthorized code during the build lifecycle by crafting a dependency source...

NPM: pnpm: Git Fetch Argument Injection via Lockfile resolution.commit

NPM: pnpm: Git Fetch Argument Injection via Lockfile resolution.commit vulnerability discovered by ? in WordPress Npm pnpm versions 10.34.0...

Arbitrary Argument Injection

Overview pnpm is a Fast, disk space efficient package manager Affected versions of this package are vulnerable to Arbitrary Argument Injection in the git fetcher at fetching/git-fetcher/src/index.ts, which passes the lockfile's resolution.commit value into git fetch and git checkout without a --...

pnpm: Git Fetch Argument Injection via Lockfile resolution.commit

Summary pnpm passes the lockfile-controlled git resolution.commit value to git fetch without a -- separator or commit-format validation. For git dependencies fetched through the shallow-fetch path, a malicious lockfile can replace the expected 40-character commit hash with a Git option such as...

GHSA-P4XF-RF54-RJ3X pnpm: Git Fetch Argument Injection via Lockfile resolution.commit

Summary pnpm passes the lockfile-controlled git resolution.commit value to git fetch without a -- separator or commit-format validation. For git dependencies fetched through the shallow-fetch path, a malicious lockfile can replace the expected 40-character commit hash with a Git option such as...

@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +14 more potentially affected by CVE-2026-50021 via pnpm (>=10.0.0, <=10.33.2)

pnpm NPM version =10.0.0, =0.1.0, =1.1.1, =3.7.16, =0.1.0-beta.3, =0.1.0, =0.1.8, =0.1.0, =0.1.0, =2.7.2, =0.0.2, =0.2.5, =0.3.14 and more Source cves: CVE-2026-50021 Source advisory: OSV:GHSA-Q6J5-FJX5-2MC3...

pnpm: Unsafe default behavior breaks integrity check

While it is unclear whether this should be classified as a vulnerability, it is being reported through this channel because the current behavior may represent an unsafe default. Summary pnpm install in non-frozen mode can accept new remote package content after detecting that the downloaded tarba...

@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +14 more potentially affected by CVE-2026-50573 via pnpm (>=10.0.0, <=10.33.2)

pnpm NPM version =10.0.0, =0.1.0, =1.1.1, =3.7.16, =0.1.0-beta.3, =0.1.0, =0.1.8, =0.1.0, =0.1.0, =2.7.2, =0.0.2, =0.2.5, =0.3.14 and more Source cves: CVE-2026-50573 Source advisory: SNYK:JS-PNPM-17668154...

GHSA-54HH-G5MX-JQCP pnpm: Unsafe default behavior breaks integrity check

While it is unclear whether this should be classified as a vulnerability, it is being reported through this channel because the current behavior may represent an unsafe default. Summary pnpm install in non-frozen mode can accept new remote package content after detecting that the downloaded tarba...

CVE-2026-53311 fuse: fix uninit-value in fuse_dentry_revalidate()

In the Linux kernel, the following vulnerability has been resolved: fuse: fix uninit-value in fusedentryrevalidate fusedentryrevalidate may be called with a dentry that didn't had -dtime initialised. The issue was found with KMSAN, where lookupopen calls dalloc, followed by drevalidate, as shown...

EUVD-2026-39832

Incorrect link resolution by display name in the custom PowerShell VPN editor in Devolutions Remote Desktop Manager 2026.2.5 through 2026.2.11 allows an authenticated attacker with write access to a shared workspace to execute a PowerShell script in another user's context via a display name...

CVE-2026-48497 Envoy: Abnormal process termination in DNS UDP filter

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.35.11, 1.36.7, 1.37.3, and 1.38.1, in cases where UDP DNS filter is configured with local resolution containing a name with the length of 255 octets or remote resolution for a name of 255 octets long...