{"action":"Upgrade pnpm to 10.34.4 or later.","affected":[{"fixed":"10.34.4","introduced":"0"},{"fixed":"11.7.0","introduced":"11.0.0"}],"component":"pnpm","cve_ids":["CVE-2026-59196"],"ecosystem":"npm","epss":0.00401,"exploited":false,"fixed_versions":["10.34.4","11.7.0"],"ghsa_id":"GHSA-fr4h-3cph-29xv","id":"tcs_01M5KFP3Q7XJA1V42FR1AGWZ0D","modified_at":"2026-07-08T08:27:19.288893719Z","published_at":"2026-06-27T00:02:51Z","references":["https://osv.dev/vulnerability/GHSA-fr4h-3cph-29xv","https://github.com/pnpm/pnpm/security/advisories/GHSA-fr4h-3cph-29xv","https://github.com/pnpm/pnpm"],"severity":{"label":"high","score":7.1},"sources":[{"source":"osv","source_id":"GHSA-fr4h-3cph-29xv","url":"https://osv.dev/vulnerability/GHSA-fr4h-3cph-29xv"}],"summary":"pnpm: Hoisted install imports lockfile alias outside node_modules"}