CVE-2026-50573

pnpm is a package manager. Prior to 10.34.0 and 11.4.0, "pnpm install" in non-frozen mode can accept new remote package content after detecting that the downloaded tarball does not match the integrity recorded in pnpm-lock.yaml. When a package is already locked with an integrity value, and the...