CVE-2026-50014

Affected software : pnpm (package manager). Vulnerability context : Prior to versions 10.34.0 and 11.4.0, pnpm passes the lockfile-controlled git resolution.commit value to git fetch without a separator or commit-format validation. In shallow-fetch paths, a malicious lockfile can replace the expe...