Threats tagged 'brew-pnpm@9-cve-2026-23888'

A path traversal vulnerability in pnpm's binary fetcher allows malicious ZIP archives or crafted extraction prefixes to write files outside the intended directory. This can lead to overwriting sensitive files such as configuration files. The flaw arises from AdmZip's extractAllTo method not validating ZIP entry paths and from unvalidated prefix concatenation in the extraction path. The vulnerability affects pnpm versions 9.15.4 and later. The CVSS score is 6.5 (medium severity).