684 matches found
CVE-2026-82392 pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph
pnpm is a package manager. Prior to 10.34.5 and from 11.0.0 until 11.11.0, pnpm parses the package name from attacker-controlled pnpm-lock.yaml packages keys with dp.parsedepPath.name and uses it without validation in deps/graph-builder/src/lockfileToDepGraph.ts and...
PT-2026-84039
Name of the Vulnerable Software and Affected Versions pnpm versions prior to 10.34.5 pnpm versions 11.0.0 through 11.10.0 Description pnpm improperly parses package names from the pnpm-lock.yaml file using the dp.parsedepPath.name function without sufficient validation. This occurs within...
CVE-2026-82392: Improper Limitation of a Pathname to a Restricted Directory
pnpm is a package manager. Prior to 10.34.5 and from 11.0.0 until 11.11.0, pnpm parses the package name from attacker-controlled pnpm-lock.yaml packages keys with dp.parsedepPath.name and uses it without validation in deps/graph-builder/src/lockfileToDepGraph.ts and...
PT-2026-84040
Name of the Vulnerable Software and Affected Versions pnpm versions prior to 10.34.5 pnpm versions prior to 11.11.0 Description pnpm accepts a scoped path traversal in a tarball dependency's package.json manifest name because the pickPackage.ts function rejects slash characters only for unscoped...
CVE-2026-82393: Improper Limitation of a Pathname to a Restricted Directory
pnpm is a package manager. Prior to 10.34.5 and 11.11.0, pnpm accepts a scoped path traversal in a tarball dependency's package.json manifest name because pnpm11/resolving/npm-resolver/src/pickPackage.ts rejects slash characters only for unscoped names. During pnpm install, the unvalidated name...
CVE-2026-59196
A flaw was found in pnpm, a package manager. This vulnerability allows a remote attacker to manipulate the package installation process by using a specially crafted lockfile alias. This could lead to path traversal, enabling the attacker to write files outside the designated installation director...
Malicious code in @onereach/pnpm-audit-junit (npm)
npm/@onereach/pnpm-audit-junit is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...
MAL-2026-11621 Malicious code in @onereach/pnpm-audit-junit (npm)
npm/@onereach/pnpm-audit-junit is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...
@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +10 more potentially affected by unknown CVE via pnpm (>=10.8.1, <=10.33.0)
pnpm NPM version =10.8.1, =0.1.0, =1.1.1, =0.1.0-beta.3, =0.1.0, =0.1.8, =0.1.0, =0.1.0, =0.2.5, =1.0.4, =1.0.7 Source cves: unknown CVE Source advisory: MEND:WS-2026-0047...
@forgeax/game (>=0.3.0, <=0.3.10), @huiliyi37/cordis-plugin-loader (>=0.2.0, <=0.8.0) +11 more potentially affected by unknown CVE via pnpm (>=11.5.3, <=11.7.0)
pnpm NPM version =11.5.3, =0.3.0, =0.2.0, =0.1.0-beta.3, =0.1.0-rc.20, =0.2.0-alpha.7, =0.1.2, =0.1.13, =2.2.0, =2.2.12 Source cves: unknown CVE Source advisory: MEND:WS-2026-0047...
ROOT-APP-NPM-CVE-2026-55699 CVE-2026-55699 in @rootio/pnpm - Patched by Root
Root has patched CVE-2026-55699 in the @rootio/pnpm package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-55487 CVE-2026-55487 in @rootio/pnpm - Patched by Root
Root has patched CVE-2026-55487 in the @rootio/pnpm package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-50016 CVE-2026-50016 in @rootio/pnpm - Patched by Root
Root has patched CVE-2026-50016 in the @rootio/pnpm package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-55698 CVE-2026-55698 in @rootio/pnpm - Patched by Root
Root has patched CVE-2026-55698 in the @rootio/pnpm package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-GHSA-FR4H-3CPH-29XV GHSA-fr4h-3cph-29xv in @rootio/pnpm - Patched by Root
Root has patched GHSA-fr4h-3cph-29xv in the @rootio/pnpm package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-50573 CVE-2026-50573 in @rootio/pnpm - Patched by Root
Root has patched CVE-2026-50573 in the @rootio/pnpm package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-50014 CVE-2026-50014 in @rootio/pnpm - Patched by Root
Root has patched CVE-2026-50014 in the @rootio/pnpm package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-55697 CVE-2026-55697 in @rootio/pnpm - Patched by Root
Root has patched CVE-2026-55697 in the @rootio/pnpm package for Root:npm. Multiple fixed versions available...