https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 15:34:16 +0000 https://db.gcve.eu/vuln/cve-2026-50016 <p><strong>Affected:</strong> pnpm</p> <p>pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm allows a transitive dependency alias from registry package metadata to contain path traversal segments. During install, pnpm later uses that alias as a filesystem path when linking dependency nodes. As a result, a registry package can cause `pnpm install --ignore-scripts` to replace paths in the current project with symlinks to attacker-controlled dependency package directories. This vulnerability is fixed in 10.34.0 and 11.4.0.</p> <p><strong>Affected:</strong> pnpm</p> <p>pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm allows a transitive dependency alias from registry package metadata to contain path traversal segments. During install, pnpm later uses that alias as a filesystem path when linking dependency nodes. As a result, a registry package can cause `pnpm install --ignore-scripts` to replace paths in the current project with symlinks to attacker-controlled dependency package directories. This vulnerability is fixed in 10.34.0 and 11.4.0.</p> https://db.gcve.eu/vuln/cve-2026-50016 https://db.gcve.eu/vuln/ghsa-hwx4-2j3j-g496 <p><strong>Affected:</strong> npm: pnpm</p> <p>## Summary</p> <p>pnpm allows a transitive dependency alias from registry package metadata to contain path traversal segments. During install, pnpm later uses that alias as a filesystem path when linking dependency nodes. As a result, a registry package can cause `pnpm install - ignore-scripts` to replace paths in the current project with symlinks to attacker-controlled dependency package directories.</p> <p>`.git/hooks` is only one useful target. The same primitive can replace other project-local paths that are consumed by later tools, for example:</p> <p>- `.husky` or `.githooks` for Git hook dispatchers - `scripts/`, `tools/`, `bin/`, or `tests/` for project scripts and CI commands - `.github/actions/&lt;name&gt;` for local GitHub Actions used later in the workflow - `dist/` or other publish/build output directories before `pnpm pack` or `pnpm publish` - `node_modules/.bin` or undeclared `node_modules/&lt;name&gt;` paths used by later command or module resolution</p> <p>Targets that are regular files can also be replaced with symlinks to a package directory, but those cases are usually denial of service. Directory targets are more useful because many developer tools execute or load files from those directories after installation.</p> <p>This was reproduced with `pnpm@11.2.1`.</p> <p>## Impact</p> <p>Users often run `pnpm install --ignore-scripts` expecting that untrusted package code cannot execute during installation. This issue bypasses that expectation: the malicious package does not need a lifecycle script. Instead,…</p> <p><strong>Affected:</strong> npm: pnpm</p> <p>## Summary</p> <p>pnpm allows a transitive dependency alias from registry package metadata to contain path traversal segments. During install, pnpm later uses that alias as a filesystem path when linking dependency nodes. As a result, a registry package can cause `pnpm install - ignore-scripts` to replace paths in the current project with symlinks to attacker-controlled dependency package directories.</p> <p>`.git/hooks` is only one useful target. The same primitive can replace other project-local paths that are consumed by later tools, for example:</p> <p>- `.husky` or `.githooks` for Git hook dispatchers - `scripts/`, `tools/`, `bin/`, or `tests/` for project scripts and CI commands - `.github/actions/&lt;name&gt;` for local GitHub Actions used later in the workflow - `dist/` or other publish/build output directories before `pnpm pack` or `pnpm publish` - `node_modules/.bin` or undeclared `node_modules/&lt;name&gt;` paths used by later command or module resolution</p> <p>Targets that are regular files can also be replaced with symlinks to a package directory, but those cases are usually denial of service. Directory targets are more useful because many developer tools execute or load files from those directories after installation.</p> <p>This was reproduced with `pnpm@11.2.1`.</p> <p>## Impact</p> <p>Users often run `pnpm install --ignore-scripts` expecting that untrusted package code cannot execute during installation. This issue bypasses that expectation: the malicious package does not need a lifecycle script. Instead,…</p> https://db.gcve.eu/vuln/ghsa-hwx4-2j3j-g496