CVE-2026-24056

pnpm is a package manager. Prior to version 10.28.2, when pnpm installs a file: directory or git: dependency, it follows symlinks and reads their target contents without constraining them to the package root. A malicious package containing a symlink to an absolute path e.g., /etc/passwd,...

CVE-2026-24056

creationtimestamp| type| source ---|---|--- 2026-01-26 15:43:05+00:00| published-proof-of-concept| https://github.com/pnpm/pnpm/security/advisories/GHSA-m733-5w8f-5ggw 2026-01-27 01:21:00+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mdelrufrxa2j...