Threats tagged 'brew-pnpm@9-cve-2026-23890'

A path traversal vulnerability in pnpm version 9.15.4 and later allows malicious npm packages to create executable shims or symlinks outside the intended node_modules/.bin directory. This occurs because bin names starting with '@' bypass validation and path traversal sequences are preserved after normalization, enabling arbitrary file creation outside the expected directory.