{"action":"Upgrade pnpm to 10.34.4 or later.","affected":[{"fixed":"10.34.4","introduced":"0"},{"fixed":"11.8.0","introduced":"11.0.0"}],"component":"pnpm","cve_ids":["CVE-2026-59195"],"ecosystem":"npm","epss":0.00401,"exploited":false,"fixed_versions":["10.34.4","11.8.0"],"ghsa_id":"GHSA-qrv3-253h-g69c","id":"tcs_01M5KG738PAXWB897GK1NHJ0FB","modified_at":"2026-07-08T08:26:43.572048973Z","published_at":"2026-06-27T00:13:18Z","references":["https://osv.dev/vulnerability/GHSA-qrv3-253h-g69c","https://github.com/pnpm/pnpm/security/advisories/GHSA-qrv3-253h-g69c","https://github.com/pnpm/pnpm"],"severity":{"label":"high","score":8.2},"sources":[{"source":"osv","source_id":"GHSA-qrv3-253h-g69c","url":"https://osv.dev/vulnerability/GHSA-qrv3-253h-g69c"}],"summary":"pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config"}