kmcom-nuxt-layers (>=2.2.0, <=2.2.12) potentially affected by CVE-2026-59196 via pnpm (11.5.3)

pnpm NPM version 11.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on pnpm and may be impacted: - kmcom-nuxt-layers =2.2.0, =2.2.12 Source cves: CVE-2026-59196 Source advisory: SNYK:JS-PNPM-17660537...

@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +11 more potentially affected by CVE-2026-59196 via pnpm (>=10.0.0, <=10.33.2)

pnpm NPM version =10.0.0, =0.1.0, =1.1.1, =3.7.16, =0.1.8, =0.1.0, =2.7.2, =0.0.2, =0.2.5, =1.0.4, =1.0.7 Source cves: CVE-2026-59196 Source advisory: SNYK:JS-PNPM-17660537...

External Control of File Name or Path

Overview @pnpm/installing.deps-resolver is a Resolves dependency graph of a package Affected versions of this package are vulnerable to External Control of File Name or Path via the lockfile alias handling process. An attacker can overwrite files or directories outside the intended nodemodules...

External Control of File Name or Path

Overview @pnpm/installing.deps-installer is a Fast, disk space efficient installation engine Affected versions of this package are vulnerable to External Control of File Name or Path via the lockfile alias handling process. An attacker can overwrite files or directories outside the intended...

@pnpm/building.commands (>=1100.0.4, <=1100.1.3), @pnpm/deps.compliance.commands (>=1101.1.1, <=1101.3.3) +8 more potentially affected by CVE-2026-59196 via @pnpm/installing.deps-installer (>=1101.0.0, <=1101.8.0)

@pnpm/installing.deps-installer NPM version =1101.0.0, =1100.0.4, =1101.1.1, =1100.1.3, =1101.0.2, =1100.0.4, =1100.0.4, =1100.1.2, =1100.0.4, =1100.2.0, =0.0.2, =0.0.21 Source cves: CVE-2026-59196 Source advisory: SNYK:JS-PNPMINSTALLINGDEPSINSTALLER-17660539...

External Control of File Name or Path

Overview @pnpm/installing.deps-restorer is a Fast installation using only pnpm-lock.yaml Affected versions of this package are vulnerable to External Control of File Name or Path via the lockfile alias handling process. An attacker can overwrite files or directories outside the intended nodemodul...

@pnpm/building.commands (>=1100.0.4, <=1100.1.3), @pnpm/deps.compliance.commands (>=1101.1.1, <=1101.3.3) +9 more potentially affected by CVE-2026-59196 via @pnpm/installing.deps-restorer (>=1101.0.0, <=1101.1.10)

@pnpm/installing.deps-restorer NPM version =1101.0.0, =1100.0.4, =1101.1.1, =1100.1.3, =1101.0.2, =1100.0.4, =1100.0.4, =1100.1.2, =1101.0.0, =1100.0.4, =1100.2.0, =0.0.2, =0.0.21 Source cves: CVE-2026-59196 Source advisory: SNYK:JS-PNPMINSTALLINGDEPSRESTORER-17660541...

GHSA-FR4H-3CPH-29XV pnpm: Hoisted install imports lockfile alias outside node_modules

Summary The hoisted dependency alias issue tracked as GHSA-fr4h-3cph-29xv / CAND-PNPM-059 has been addressed in both pnpm and pacquet. A crafted lockfile alias could be joined directly under a hoisted nodemodules directory. Traversal aliases could escape that directory, while reserved aliases suc...

kmcom-nuxt-layers (>=2.2.0, <=2.2.12) potentially affected by CVE-2026-59196 via pnpm (11.5.3)

pnpm NPM version 11.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on pnpm and may be impacted: - kmcom-nuxt-layers =2.2.0, =2.2.12 Source cves: CVE-2026-59196 Source advisory: OSV:GHSA-FR4H-3CPH-29XV...

External Control of File Name or Path

Overview pnpm is a Fast, disk space efficient package manager Affected versions of this package are vulnerable to External Control of File Name or Path via the lockfile alias handling process. An attacker can overwrite files or directories outside the intended nodemodules directory by crafting a...

@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +11 more potentially affected by CVE-2026-59196 via pnpm (>=10.0.0, <=10.33.2)

pnpm NPM version =10.0.0, =0.1.0, =1.1.1, =3.7.16, =0.1.8, =0.1.0, =2.7.2, =0.0.2, =0.2.5, =1.0.4, =1.0.7 Source cves: CVE-2026-59196 Source advisory: OSV:GHSA-FR4H-3CPH-29XV...

PT-2026-55946

Name of the Vulnerable Software and Affected Versions pnpm versions prior to 10.34.4 pnpm versions prior to 11.7.0 Description A crafted patch entry can resolve outside the configured patches directory, allowing the pnpm patch-remove command to delete an arbitrary reachable file. Recommendations...

@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +11 more potentially affected by CVE-2026-55699 via pnpm (>=10.0.0, <=10.33.2)

pnpm NPM version =10.0.0, =0.1.0, =1.1.1, =3.7.16, =0.1.8, =0.1.0, =2.7.2, =0.0.2, =0.2.5, =1.0.4, =1.0.7 Source cves: CVE-2026-55699 Source advisory: OSV:GHSA-4GXM-V5V7-FQC4...

@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +11 more potentially affected by CVE-2026-55699 via pnpm (>=10.0.0, <=10.33.2)

pnpm NPM version =10.0.0, =0.1.0, =1.1.1, =3.7.16, =0.1.8, =0.1.0, =2.7.2, =0.0.2, =0.2.5, =1.0.4, =1.0.7 Source cves: CVE-2026-55699 Source advisory: SNYK:JS-PNPM-17661053...

@pnpm/bins.linker (>=1100.0.0, <=1100.0.10), @pnpm/bins.remover (>=1100.0.0, <=1100.0.6) +29 more potentially affected by CVE-2026-55699 via @pnpm/bins.resolver (>=1100.0.0, <=1100.0.5)

@pnpm/bins.resolver NPM version =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.0, =1100.0.24 and more Source cves: CVE-2026-55699 Source advisory:...

GHSA-4GXM-V5V7-FQC4 pnpm: Reserved bin name deletes PNPM_HOME during global remove

Maintainer Action Plan Maintainer Action Plan This report is ready to review with the shared patch branch. Start with the PR and the expected fixed behavior, then use the detailed exploit narrative below only if you want to replay the original path. - Advisory: CAND-PNPM-085 / GHSA-4gxm-v5v7-fqc4...

EUVD-2026-39485

pnpm: Reserved bin name deletes PNPMHOME during global remove...

@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +11 more potentially affected by CVE-2026-55698 via pnpm (>=10.0.0, <=10.33.2)

pnpm NPM version =10.0.0, =0.1.0, =1.1.1, =3.7.16, =0.1.8, =0.1.0, =2.7.2, =0.0.2, =0.2.5, =1.0.4, =1.0.7 Source cves: CVE-2026-55698 Source advisory: OSV:GHSA-W466-C33R-3GJP...

GHSA-W466-C33R-3GJP pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes

Maintainer Action Plan This report is ready to review with the shared patch branch. Start with the PR and the expected fixed behavior, then use the detailed exploit narrative below only if you want to replay the original path. - Advisory: CAND-PNPM-063 / GHSA-w466-c33r-3gjp - Advisory URL:...

@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +11 more potentially affected by CVE-2026-55697 via pnpm (>=10.0.0, <=10.33.2)

pnpm NPM version =10.0.0, =0.1.0, =1.1.1, =3.7.16, =0.1.8, =0.1.0, =2.7.2, =0.0.2, =0.2.5, =1.0.4, =1.0.7 Source cves: CVE-2026-55697 Source advisory: OSV:GHSA-GJ8W-MVPF-X27X...