A vulnerability, which was classified as critical, has been found in pnpm up to 10.28.1. This affects the function
path.join. This manipulation of the argument directories.bin causes path traversal.
The identification of this vulnerability is CVE-2026-24131. It is possible to initiate the attack remotely. There is no exploit available.
It is advisable to upgrade the affected component.
