https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T16:45:52.022875+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-59196 CVE-2026-59196 — pnpm: hoisted install imports lockfile alias outside node_modules 2026-10-04T16:45:52.039012+00:00

Affected: pnpm

pnpm is a package manager. Prior to 10.34.4 and 11.7.0, a crafted lockfile alias could be joined directly under a hoisted node_modules directory. Traversal aliases could escape that directory, while reserved aliases such as .bin or .pnpm could overwrite pnpm-owned layout. This vulnerability is fixed in 10.34.4 and 11.7.0.