GHSA-HWX4-2J3J-G496 pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement

Summary pnpm allows a transitive dependency alias from registry package metadata to contain path traversal segments. During install, pnpm later uses that alias as a filesystem path when linking dependency nodes. As a result, a registry package can cause pnpm install - ignore-scripts to replace...

NPM: pnpm: Git Fetch Argument Injection via Lockfile resolution.commit

NPM: pnpm: Git Fetch Argument Injection via Lockfile resolution.commit vulnerability discovered by ? in WordPress Npm pnpm versions 10.34.0...

EUVD-2026-39490

pnpm: Git Fetch Argument Injection via Lockfile resolution.commit...

Arbitrary Argument Injection

Overview pnpm is a Fast, disk space efficient package manager Affected versions of this package are vulnerable to Arbitrary Argument Injection in the git fetcher at fetching/git-fetcher/src/index.ts, which passes the lockfile's resolution.commit value into git fetch and git checkout without a --...

pnpm: Git Fetch Argument Injection via Lockfile resolution.commit

Summary pnpm passes the lockfile-controlled git resolution.commit value to git fetch without a -- separator or commit-format validation. For git dependencies fetched through the shallow-fetch path, a malicious lockfile can replace the expected 40-character commit hash with a Git option such as...

GHSA-P4XF-RF54-RJ3X pnpm: Git Fetch Argument Injection via Lockfile resolution.commit

Summary pnpm passes the lockfile-controlled git resolution.commit value to git fetch without a -- separator or commit-format validation. For git dependencies fetched through the shallow-fetch path, a malicious lockfile can replace the expected 40-character commit hash with a Git option such as...

Hackney has an infinite loop on non-token byte at start of an Alt-Svc entry

Summary CVE-2026-47066 is an infinite loop CWE-835 in hackney's Alt-Svc response header parser src/hackneyaltsvc.erl. When an HTTP server returns an Alt-Svc header whose value begins with a non-token byte e.g. !, @, =, ;, the parser enters a tight tail-recursive loop that pins an Erlang scheduler...

GHSA-6CP8-V795-JR2J Hackney has an infinite loop on non-token byte at start of an Alt-Svc entry

Summary CVE-2026-47066 is an infinite loop CWE-835 in hackney's Alt-Svc response header parser src/hackneyaltsvc.erl. When an HTTP server returns an Alt-Svc header whose value begins with a non-token byte e.g. !, @, =, ;, the parser enters a tight tail-recursive loop that pins an Erlang scheduler...

Missing Support for Integrity Check

Overview pnpm is a Fast, disk space efficient package manager Affected versions of this package are vulnerable to Missing Support for Integrity Check involving GitHub git dependencies, because the tarball hash for packages resolved from codeload.github.com is not recorded in the lockfile. An...

NPM: pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile

NPM: pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile vulnerability discovered by ? in WordPress Npm pnpm versions 10.33.4...

EUVD-2026-39497

pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile...

pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile

Summary A malicious codeload.github.com server can serve whatever tarball it wants and pnpm will install it regardless of the lockfile. Details The lockfile does not store the hash of the dependencies from https://codeload.github.com This means that if this server was compromised or a person's...

GHSA-HG3W-7F8C-63HP pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile

Summary A malicious codeload.github.com server can serve whatever tarball it wants and pnpm will install it regardless of the lockfile. Details The lockfile does not store the hash of the dependencies from https://codeload.github.com This means that if this server was compromised or a person's...

Cargo can be coerced to share credentials between registries

The Rust Security Response Team was notified that Cargo incorrectly normalized the URLs of third-party registries using the sparse index protocol1. If a hosting provider allowed multiple registries to be hosted with arbitrary names within the same domain, an attacker able to publish crates in a...

GHSA-P688-R7JV-FM6F Cargo can be coerced to share credentials between registries

The Rust Security Response Team was notified that Cargo incorrectly normalized the URLs of third-party registries using the sparse index protocol1. If a hosting provider allowed multiple registries to be hosted with arbitrary names within the same domain, an attacker able to publish crates in a...

phpMyFAQ has an incomplete fix for GHSA-xvp4-phqj-cjr3 — editUser() and updateUserRights() lack authorization guards

Advisory / Disclosure phpMyFAQ 4.1.3 — incomplete fix for the admin-API IDOR/privilege-escalation class Target: thorsten/phpMyFAQ composer: thorsten/phpmyfaq, phpmyfaq/phpmyfaq Affected: "Only SuperAdmins may change other users' attributes. Self-service is always allowed." and "a non-SuperAdmin...

GHSA-985R-Q3QP-299H phpMyFAQ has an incomplete fix for GHSA-xvp4-phqj-cjr3 — editUser() and updateUserRights() lack authorization guards

Advisory / Disclosure phpMyFAQ 4.1.3 — incomplete fix for the admin-API IDOR/privilege-escalation class Target: thorsten/phpMyFAQ composer: thorsten/phpmyfaq, phpmyfaq/phpmyfaq Affected: "Only SuperAdmins may change other users' attributes. Self-service is always allowed." and "a non-SuperAdmin...

Prototype Pollution

Overview n8n-workflow is a Workflow base code of n8n Affected versions of this package are vulnerable to Prototype Pollution via the deepCopy and replaceCircularReferences utilities in utils.ts. An attacker can inject crafted proto, constructor, or prototype fields in a public webhook payload tha...

Prototype Pollution

Overview @deepstream/server is an a scalable server for realtime webapps Affected versions of this package are vulnerable to Prototype Pollution via the message processing pipeline. An attacker can escalate privileges and potentially gain unauthorized access or modify sensitive data by sending...

Scriban: ExpressionDepthLimit guard is non-enforcing — parser-recursion DoS in 6.6.0–7.2.0 (incomplete fix for GHSA-wgh7-7m3c-fx25 / GHSA-p6q4-fgr8-vx4p)

Summary The ExpressionDepthLimit parser guard in Scriban does not actually stop parsing — it only logs a non-fatal error and lets recursive descent continue. As a result, a template containing a deeply nested expression parentheses, array initializers, object initializers, or unary operators driv...