GHSA-2RX9-3G3H-C2JV pnpm: pacquet trust-lockfile install can create dependency symlinks outside the project

Summary A crafted lockfile alias could reach several install-time filesystem joins. With --trust-lockfile or a frozen lockfile, traversal segments could create links outside the intended project or nodemodules boundary. This patch validates dependency names and every virtual-store slot before...

pnpm: pacquet trust-lockfile install can create dependency symlinks outside the project

Summary A crafted lockfile alias could reach several install-time filesystem joins. With --trust-lockfile or a frozen lockfile, traversal segments could create links outside the intended project or nodemodules boundary. This patch validates dependency names and every virtual-store slot before...

NPM: pnpm: pacquet trust-lockfile install can create dependency symlinks outside the project

NPM: pnpm: pacquet trust-lockfile install can create dependency symlinks outside the project vulnerability discovered by ? in WordPress Npm pnpm versions = 12.0.0-alpha.0, 12.0.0-alpha.5...