Vulnerabilities
CVE-2026-24131 - pnpm has Path Traversal via arbitrary file permission modification
CVE ID : CVE-2026-24131 Published : Jan. 26, 2026, 10:15 p.m. | 1 hour, 33 minutes ago Description : pnpm is a package manager. Prior to version 10.28.2, when pnpm processes a package's `directories.bin` field, it uses `path.join()` without validating the result stays within the package root. A malicious npm package can specify `
CVE Details
CVE ID
Published
Jan. 26, 2026