@pnpm/building.commands (>=1100.0.0, <=1100.1.3), @pnpm/deps.compliance.commands (>=1100.0.0, <=1101.3.3) +10 more potentially affected by CVE-2026-59196 via @pnpm/installing.deps-resolver (>=1100.0.0, <=1100.2.1)

@pnpm/installing.deps-resolver NPM version =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =0.0.1, =0.0.21 Source cves: CVE-2026-59196 Source advisory: SNYK:JS-PNPMINSTALLINGDEPSRESOLVER-17660540...

@pnpm/building.commands (>=1100.0.0, <=1100.1.3), @pnpm/deps.compliance.commands (>=1100.0.0, <=1101.3.3) +12 more potentially affected by CVE-2026-59196 via @pnpm/fs.symlink-dependency (>=1100.0.0, <=1100.0.8)

@pnpm/fs.symlink-dependency NPM version =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =0.0.1, =0.0.21 Source cves: CVE-2026-59196 Source advisory: SNYK:JS-PNPMFSSYMLINKDEPENDENCY-17660538...

kmcom-nuxt-layers (>=2.2.0, <=2.2.12) potentially affected by CVE-2026-59196 via pnpm (11.5.3)

pnpm NPM version 11.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on pnpm and may be impacted: - kmcom-nuxt-layers =2.2.0, =2.2.12 Source cves: CVE-2026-59196 Source advisory: SNYK:JS-PNPM-17660537...

@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +11 more potentially affected by CVE-2026-59196 via pnpm (>=10.0.0, <=10.33.2)

pnpm NPM version =10.0.0, =0.1.0, =1.1.1, =3.7.16, =0.1.8, =0.1.0, =2.7.2, =0.0.2, =0.2.5, =1.0.4, =1.0.7 Source cves: CVE-2026-59196 Source advisory: SNYK:JS-PNPM-17660537...

@pnpm/building.commands (>=1100.0.4, <=1100.1.3), @pnpm/deps.compliance.commands (>=1101.1.1, <=1101.3.3) +8 more potentially affected by CVE-2026-59196 via @pnpm/installing.deps-installer (>=1101.0.0, <=1101.8.0)

@pnpm/installing.deps-installer NPM version =1101.0.0, =1100.0.4, =1101.1.1, =1100.1.3, =1101.0.2, =1100.0.4, =1100.0.4, =1100.1.2, =1100.0.4, =1100.2.0, =0.0.2, =0.0.21 Source cves: CVE-2026-59196 Source advisory: SNYK:JS-PNPMINSTALLINGDEPSINSTALLER-17660539...

@pnpm/building.commands (>=1100.0.4, <=1100.1.3), @pnpm/deps.compliance.commands (>=1101.1.1, <=1101.3.3) +9 more potentially affected by CVE-2026-59196 via @pnpm/installing.deps-restorer (>=1101.0.0, <=1101.1.10)

@pnpm/installing.deps-restorer NPM version =1101.0.0, =1100.0.4, =1101.1.1, =1100.1.3, =1101.0.2, =1100.0.4, =1100.0.4, =1100.1.2, =1101.0.0, =1100.0.4, =1100.2.0, =0.0.2, =0.0.21 Source cves: CVE-2026-59196 Source advisory: SNYK:JS-PNPMINSTALLINGDEPSRESTORER-17660541...

@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +11 more potentially affected by CVE-2026-59196 via pnpm (>=10.0.0, <=10.33.2)

pnpm NPM version =10.0.0, =0.1.0, =1.1.1, =3.7.16, =0.1.8, =0.1.0, =2.7.2, =0.0.2, =0.2.5, =1.0.4, =1.0.7 Source cves: CVE-2026-59196 Source advisory: OSV:GHSA-FR4H-3CPH-29XV...

GHSA-FR4H-3CPH-29XV pnpm: Hoisted install imports lockfile alias outside node_modules

Summary The hoisted dependency alias issue tracked as GHSA-fr4h-3cph-29xv / CAND-PNPM-059 has been addressed in both pnpm and pacquet. A crafted lockfile alias could be joined directly under a hoisted nodemodules directory. Traversal aliases could escape that directory, while reserved aliases suc...

kmcom-nuxt-layers (>=2.2.0, <=2.2.12) potentially affected by CVE-2026-59196 via pnpm (11.5.3)

pnpm NPM version 11.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on pnpm and may be impacted: - kmcom-nuxt-layers =2.2.0, =2.2.12 Source cves: CVE-2026-59196 Source advisory: OSV:GHSA-FR4H-3CPH-29XV...

@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +11 more potentially affected by CVE-2026-55699 via pnpm (>=10.0.0, <=10.33.2)

pnpm NPM version =10.0.0, =0.1.0, =1.1.1, =3.7.16, =0.1.8, =0.1.0, =2.7.2, =0.0.2, =0.2.5, =1.0.4, =1.0.7 Source cves: CVE-2026-55699 Source advisory: OSV:GHSA-4GXM-V5V7-FQC4...

@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +11 more potentially affected by CVE-2026-55699 via pnpm (>=10.0.0, <=10.33.2)

pnpm NPM version =10.0.0, =0.1.0, =1.1.1, =3.7.16, =0.1.8, =0.1.0, =2.7.2, =0.0.2, =0.2.5, =1.0.4, =1.0.7 Source cves: CVE-2026-55699 Source advisory: SNYK:JS-PNPM-17661053...

@pnpm/bins.linker (>=1100.0.0, <=1100.0.10), @pnpm/bins.remover (>=1100.0.0, <=1100.0.6) +29 more potentially affected by CVE-2026-55699 via @pnpm/bins.resolver (>=1100.0.0, <=1100.0.5)

@pnpm/bins.resolver NPM version =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.24 and more Source cves: CVE-2026-55699 Source advisory:...

@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +11 more potentially affected by CVE-2026-55698 via pnpm (>=10.0.0, <=10.33.2)

pnpm NPM version =10.0.0, =0.1.0, =1.1.1, =3.7.16, =0.1.8, =0.1.0, =2.7.2, =0.0.2, =0.2.5, =1.0.4, =1.0.7 Source cves: CVE-2026-55698 Source advisory: OSV:GHSA-W466-C33R-3GJP...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the id parameter in playlist operations. An attacker can access or delete other users' playlists, and probe for the existence of arbitrary files by supplying a crafted base64-encoded...

@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +11 more potentially affected by CVE-2026-55697 via pnpm (>=10.0.0, <=10.33.2)

pnpm NPM version =10.0.0, =0.1.0, =1.1.1, =3.7.16, =0.1.8, =0.1.0, =2.7.2, =0.0.2, =0.2.5, =1.0.4, =1.0.7 Source cves: CVE-2026-55697 Source advisory: OSV:GHSA-GJ8W-MVPF-X27X...

@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +11 more potentially affected by CVE-2026-55487 via pnpm (>=10.0.0, <=10.33.2)

pnpm NPM version =10.0.0, =0.1.0, =1.1.1, =3.7.16, =0.1.8, =0.1.0, =2.7.2, =0.0.2, =0.2.5, =1.0.4, =1.0.7 Source cves: CVE-2026-55487 Source advisory: OSV:GHSA-5WX6-MG75-V57R...

@pnpm/building.after-install (>=1100.0.0, <=1101.0.18), @pnpm/building.commands (>=1100.0.0, <=1100.1.1) +11 more potentially affected by CVE-2026-55487 via @pnpm/building.policy (>=1100.0.0, <=1100.0.7)

@pnpm/building.policy NPM version =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =0.0.1, =0.0.21 Source cves: CVE-2026-55487 Source advisory: SNYK:JS-PNPMBUILDINGPOLICY-17661052...

@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +11 more potentially affected by CVE-2026-55487 via pnpm (>=10.0.0, <=10.33.2)

pnpm NPM version =10.0.0, =0.1.0, =1.1.1, =3.7.16, =0.1.8, =0.1.0, =2.7.2, =0.0.2, =0.2.5, =1.0.4, =1.0.7 Source cves: CVE-2026-55487 Source advisory: SNYK:JS-PNPM-17661051...

Unsafe Dependency Resolution

Overview @pnpm/building.policy is a Create a function for filtering out dependencies that are not allowed to be built Affected versions of this package are vulnerable to Unsafe Dependency Resolution via the approval process for dependency sources. An attacker can execute unauthorized code during...

Unsafe Dependency Resolution

Overview pnpm is a Fast, disk space efficient package manager Affected versions of this package are vulnerable to Unsafe Dependency Resolution via the approval process for dependency sources. An attacker can execute unauthorized code during the build lifecycle by crafting a dependency source...