pnpm version 9.15.4 and later has a vulnerability where it follows symlinks in file: and git: dependencies without restricting access to the package root. This can lead to local file disclosure if a malicious package includes symlinks to sensitive files such as /etc/passwd or SSH keys. The issue does not affect registry packages published to npm, as symlinks are stripped there. The vulnerability has a CVSS score of 6.5 (medium severity).