https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-03T10:48:54.877740+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/brew-pnpm-cve-2026-23890 BREW-pnpm-CVE-2026-23890 — pnpm scoped bin name Path Traversal allows arbitrary file creation outside node_modules/.bin 2026-10-03T10:48:54.882117+00:00

Affected: Homebrew: pnpm

pnpm is a package manager. Prior to version 10.28.1, a path traversal vulnerability in pnpm's bin linking allows malicious npm packages to create executable shims or symlinks outside of `node_modules/.bin`. Bin names starting with `@` bypass validation, and after scope normalization, path traversal sequences like `../../` remain intact. This issue affects all pnpm users who install npm packages and CI/CD pipelines using pnpm. It can lead to overwriting config files, scripts, or other sensitive files. Version 10.28.1 contains a patch.

 https://db.gcve.eu/vuln/cve-2026-23890 CVE-2026-23890 — pnpm scoped bin name Path Traversal allows arbitrary file creation outside node_modules/.bin 2026-10-03T10:48:54.882225+00:00

Affected: pnpm

pnpm is a package manager. Prior to version 10.28.1, a path traversal vulnerability in pnpm's bin linking allows malicious npm packages to create executable shims or symlinks outside of `node_modules/.bin`. Bin names starting with `@` bypass validation, and after scope normalization, path traversal sequences like `../../` remain intact. This issue affects all pnpm users who install npm packages and CI/CD pipelines using pnpm. It can lead to overwriting config files, scripts, or other sensitive files. Version 10.28.1 contains a patch.