@cedar-policy/authorization-for-expressjs has an authorization bypass via query string manipulation

CVE-2026-49473

### Summary @cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar auth

历史摘要 · 未重新核验 · GitHub Advisory

pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config

## Summary `pnpm` accepts package names from the env lockfile `configDependencies` section and uses those names directl

历史摘要 · 未重新核验 · GitHub Advisory

pnpm: `patch-remove` could delete project-selected files outside the patches directory

## Summary The `patch-remove` deletion-scope issue tracked as GHSA-72r4-9c5j-mj57 / CAND-PNPM-030 has been addressed in

历史摘要 · 未重新核验 · GitHub Advisory

pnpm: Hoisted install imports lockfile alias outside node_modules

## Summary The hoisted dependency alias issue tracked as GHSA-fr4h-3cph-29xv / CAND-PNPM-059 has been addressed in both

历史摘要 · 未重新核验 · GitHub Advisory

pnpm: `stage download` writes outside its destination directory via manifest name/version traversal

CVE-2026-55700

## Summary The staged-tarball filename traversal reported as GHSA-v23m-ccfg-pq9h / CAND-PNPM-038 is fixed on `main` by

历史摘要 · 未重新核验 · GitHub Advisory

pnpm: Reserved bin name deletes PNPM_HOME during global remove

CVE-2026-55699

Maintainer Action Plan ## Maintainer Action Plan This report is ready to review with the shared patch branch. Start w

历史摘要 · 未重新核验 · GitHub Advisory

pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes

CVE-2026-55698

## Maintainer Action Plan This report is ready to review with the shared patch branch. Start with the PR and the expec

历史摘要 · 未重新核验 · GitHub Advisory

pnpm: Repository-controlled configDependencies can select a pacquet native install engine

CVE-2026-55697

## Maintainer Action Plan This report is ready to review with the shared patch branch. Start with the PR and the expec

历史摘要 · 未重新核验 · GitHub Advisory

pnpm: Manifest identity spoof satisfies allowBuilds and runs attacker lifecycle

CVE-2026-55487

## Summary Keep build approval for opaque dependency sources byte-exact for GHSA-5wx6-mg75-v57r / CAND-PNPM-123. Merge

历史摘要 · 未重新核验 · GitHub Advisory

pnpm: Repository config can expand victim environment secrets into registry requests before scripts run

CVE-2026-55180

## Maintainer Action Plan This report is ready to review with the shared patch branch. Start with the PR and the expec

历史摘要 · 未重新核验 · GitHub Advisory

pnpm Vulnerable to Arbitrary File Write/Delete via Malicious Patch File (Path Traversal)

CVE-2026-50015

## Summary pnpm's patch application pipeline (`@pnpm/patch-package`) performs no path validation on file paths extracte

历史摘要 · 未重新核验 · GitHub Advisory

pnpm binds unscoped user-level npm auth credentials to a repository-selected registry

CVE-2026-50017

## Summary pnpm can send user-level unscoped npm authentication credentials to a registry chosen by a repository-local

历史摘要 · 未重新核验 · GitHub Advisory

pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement

CVE-2026-50016

## Summary pnpm allows a transitive dependency alias from registry package metadata to contain path traversal segments.

历史摘要 · 未重新核验 · GitHub Advisory

pnpm: Git Fetch Argument Injection via Lockfile resolution.commit

CVE-2026-50014

## Summary pnpm passes the lockfile-controlled git `resolution.commit` value to `git fetch` without a `--` separator or

历史摘要 · 未重新核验 · GitHub Advisory

pnpm Has an Integrity Check Bypass via Missing Lockfile Integrity Field

CVE-2026-50021

## Summary pnpm's tarball extraction worker skips integrity verification when the `integrity` field is absent from the

历史摘要 · 未重新核验 · GitHub Advisory

pnpm: Unsafe default behavior breaks integrity check

CVE-2026-50573

While it is unclear whether this should be classified as a vulnerability, it is being reported through this channel beca

历史摘要 · 未重新核验 · GitHub Advisory

js-toml has silent type confusion via falsy-primitive duplicate-key bypass

CVE-2026-50029

### Summary `js-toml`'s interpreter checks whether a key already exists in a parser-built container with `if (object[ke

历史摘要 · 未重新核验 · GitHub Advisory

@microsoft/kiota-http-fetchlibrary: Bearer token and Cookie leak across origin on redirect due to case-mismatched scrub in fetchRequestAdapter

CVE-2026-49336

### Summary `@microsoft/kiota-http-fetchlibrary`'s `RedirectHandler` is documented as stripping `Authorization` and `Co

历史摘要 · 未重新核验 · GitHub Advisory

js-toml vulnerable to CPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literals

CVE-2026-49293

## Summary `js-toml` versions up to and including **1.1.0** parse hexadecimal / octal / binary integer literals via a h

历史摘要 · 未重新核验 · GitHub Advisory

Streamable HTTP mode exposes LINE Desktop read/send tools without MCP authentication

CVE-2026-49357

# Streamable HTTP mode exposes LINE Desktop read/send tools without MCP authentication ## Summary `line-desktop-mcp` s

历史摘要 · 未重新核验 · GitHub Advisory