CVE-2026-101044

pacquet, the Rust package-manager component shipped in the pnpm npm package versions =12.0.0-alpha.0 and 12.0.0-alpha.5, does not validate dependency alias/name paths taken from a lockfile before using them in install-time filesystem joins. When a user installs a project with an attacker-supplied...