A vulnerability was found in pnpm up to 10.28.0. It has been classified as critical. Affected by this issue is some unknown functionality of the component Prefix Handler. The manipulation leads to path traversal.
This vulnerability is listed as CVE-2026-23888. The attack may be initiated remotely. There is no available exploit.
Upgrading the affected component is recommended.
