Code execution via Windows current-directory binary planting

Untrusted search path handling in pnpm before 6.15.1 allows attackers to execute arbitrary code through a malicious Windows project. When pnpm invokes tools such as Git by name, Windows searches the current working directory first, so a planted executable runs instead of the trusted binary. A victim must obtain the attacker-controlled files and run a pnpm command from that directory; the planted program then executes with the victim's privileges.