https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 12:34:06 +0000 https://vulnerability.circl.lu/vuln/brew-pnpm-cve-2026-24131 <p><strong>Affected:</strong> Homebrew: pnpm</p> <p>pnpm is a package manager. Prior to version 10.28.2, when pnpm processes a package&#39;s `directories.bin` field, it uses `path.join()` without validating the result stays within the package root. A malicious npm package can specify `&#34;directories&#34;: {&#34;bin&#34;: &#34;../../../../tmp&#34;}` to escape the package directory, causing pnpm to chmod 755 files at arbitrary locations. This issue only affects Unix/Linux/macOS. Windows is not affected (`fixBin` gated by `EXECUTABLE_SHEBANG_SUPPORTED`). Version 10.28.2 contains a patch.</p> <p><strong>Affected:</strong> Homebrew: pnpm</p> <p>pnpm is a package manager. Prior to version 10.28.2, when pnpm processes a package&#39;s `directories.bin` field, it uses `path.join()` without validating the result stays within the package root. A malicious npm package can specify `&#34;directories&#34;: {&#34;bin&#34;: &#34;../../../../tmp&#34;}` to escape the package directory, causing pnpm to chmod 755 files at arbitrary locations. This issue only affects Unix/Linux/macOS. Windows is not affected (`fixBin` gated by `EXECUTABLE_SHEBANG_SUPPORTED`). Version 10.28.2 contains a patch.</p> https://vulnerability.circl.lu/vuln/brew-pnpm-cve-2026-24131 https://vulnerability.circl.lu/vuln/cve-2026-24131 <p><strong>Affected:</strong> pnpm</p> <p>pnpm is a package manager. Prior to version 10.28.2, when pnpm processes a package&#39;s `directories.bin` field, it uses `path.join()` without validating the result stays within the package root. A malicious npm package can specify `&#34;directories&#34;: {&#34;bin&#34;: &#34;../../../../tmp&#34;}` to escape the package directory, causing pnpm to chmod 755 files at arbitrary locations. This issue only affects Unix/Linux/macOS. Windows is not affected (`fixBin` gated by `EXECUTABLE_SHEBANG_SUPPORTED`). Version 10.28.2 contains a patch.</p> <p><strong>Affected:</strong> pnpm</p> <p>pnpm is a package manager. Prior to version 10.28.2, when pnpm processes a package&#39;s `directories.bin` field, it uses `path.join()` without validating the result stays within the package root. A malicious npm package can specify `&#34;directories&#34;: {&#34;bin&#34;: &#34;../../../../tmp&#34;}` to escape the package directory, causing pnpm to chmod 755 files at arbitrary locations. This issue only affects Unix/Linux/macOS. Windows is not affected (`fixBin` gated by `EXECUTABLE_SHEBANG_SUPPORTED`). Version 10.28.2 contains a patch.</p> https://vulnerability.circl.lu/vuln/cve-2026-24131