mirror of
https://github.com/pnpm/pnpm.git
synced 2026-07-29 00:47:13 -04:00
246 B
246 B
@pnpm/package-bins, pnpm
| @pnpm/package-bins | pnpm |
|---|---|
| patch | patch |
Fixed a path traversal vulnerability in pnpm's bin linking. Bin names starting with @ bypassed validation, and after scope normalization, path traversal sequences like ../../ remained intact.