pnpm (npm)
Advisories
51
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 12.0.0-alpha.5 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install pnpm@12.0.0-alpha.5yarn
yarn add pnpm@12.0.0-alpha.5pnpm
pnpm add pnpm@12.0.0-alpha.5Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-vx52-2968-3vc6 pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml |
High EPSS 0.29% |
>= 11.0.0, < 11.11.0 | 11.11.0 |
| GHSA-vx52-2968-3vc6 pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml |
High EPSS 0.29% |
>= 10.7.0, < 10.34.5 | 10.34.5 |
| GHSA-2rx9-3g3h-c2jv pnpm: pacquet trust-lockfile install can create dependency symlinks outside the project |
High | >= 12.0.0-alpha.0, < 12.0.0-alpha.5 | 12.0.0-alpha.5 |
| GHSA-vq4v-j7r6-jq4m pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install |
High EPSS 0.63% |
< 10.34.5 | 10.34.5 |
| GHSA-vq4v-j7r6-jq4m pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install |
High EPSS 0.63% |
>= 11.0.0, < 11.11.0 | 11.11.0 |
| GHSA-c59q-g84q-2gj5 pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph |
High EPSS 0.61% |
< 10.34.5 | 10.34.5 |
| GHSA-c59q-g84q-2gj5 pnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraph |
High EPSS 0.61% |
>= 11.0.0, < 11.11.0 | 11.11.0 |
| GHSA-qrv3-253h-g69c pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config |
High EPSS 0.40% |
>= 11.0.0, < 11.8.0 | 11.8.0 |
| GHSA-qrv3-253h-g69c pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config |
High EPSS 0.40% |
< 10.34.4 | 10.34.4 |
| GHSA-72r4-9c5j-mj57 pnpm: `patch-remove` could delete project-selected files outside the patches directory |
High EPSS 0.40% |
< 10.34.4 | 10.34.4 |
| GHSA-72r4-9c5j-mj57 pnpm: `patch-remove` could delete project-selected files outside the patches directory |
High EPSS 0.40% |
>= 11.0.0, < 11.7.0 | 11.7.0 |
| GHSA-fr4h-3cph-29xv pnpm: Hoisted install imports lockfile alias outside node_modules |
High EPSS 0.40% |
>= 11.0.0, < 11.7.0 | 11.7.0 |
| GHSA-fr4h-3cph-29xv pnpm: Hoisted install imports lockfile alias outside node_modules |
High EPSS 0.40% |
< 10.34.4 | 10.34.4 |
| GHSA-v23m-ccfg-pq9h pnpm: `stage download` writes outside its destination directory via manifest name/version traversal |
High EPSS 0.42% |
>= 11.3.0, < 11.5.3 | 11.5.3 |
| GHSA-4gxm-v5v7-fqc4 pnpm: Reserved bin name deletes PNPM_HOME during global remove |
Medium EPSS 0.45% |
< 10.34.2 | 10.34.2 |
| GHSA-4gxm-v5v7-fqc4 pnpm: Reserved bin name deletes PNPM_HOME during global remove |
Medium EPSS 0.45% |
>= 11.0.0, < 11.5.3 | 11.5.3 |
| GHSA-w466-c33r-3gjp pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes |
High EPSS 0.30% |
>= 11.0.0, < 11.5.3 | 11.5.3 |
| GHSA-w466-c33r-3gjp pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes |
High EPSS 0.30% |
< 10.34.2 | 10.34.2 |
| GHSA-gj8w-mvpf-x27x pnpm: Repository-controlled configDependencies can select a pacquet native install engine |
High EPSS 0.19% |
< 10.34.2 | 10.34.2 |
| GHSA-gj8w-mvpf-x27x pnpm: Repository-controlled configDependencies can select a pacquet native install engine |
High EPSS 0.19% |
>= 11.0.0, < 11.5.3 | 11.5.3 |
| GHSA-5wx6-mg75-v57r pnpm: Manifest identity spoof satisfies allowBuilds and runs attacker lifecycle |
High EPSS 0.18% |
< 10.34.2 | 10.34.2 |
| GHSA-5wx6-mg75-v57r pnpm: Manifest identity spoof satisfies allowBuilds and runs attacker lifecycle |
High EPSS 0.18% |
>= 11.0.0, < 11.5.3 | 11.5.3 |
| GHSA-3qhv-2rgh-x77r pnpm: Repository config can expand victim environment secrets into registry requests before scripts run |
Medium EPSS 0.37% |
>= 11.0.0, < 11.5.3 | 11.5.3 |
| GHSA-3qhv-2rgh-x77r pnpm: Repository config can expand victim environment secrets into registry requests before scripts run |
Medium EPSS 0.37% |
< 10.34.2 | 10.34.2 |
| GHSA-54hh-g5mx-jqcp pnpm: Unsafe default behavior breaks integrity check |
High EPSS 0.17% |
< 10.34.0 | 10.34.0 |
| GHSA-54hh-g5mx-jqcp pnpm: Unsafe default behavior breaks integrity check |
High EPSS 0.17% |
>= 11.0.0, < 11.4.0 | 11.4.0 |
| GHSA-q6j5-fjx5-2mc3 pnpm Has an Integrity Check Bypass via Missing Lockfile Integrity Field |
High EPSS 0.18% |
< 10.34.1 | 10.34.1 |
| GHSA-q6j5-fjx5-2mc3 pnpm Has an Integrity Check Bypass via Missing Lockfile Integrity Field |
High EPSS 0.18% |
>= 11.0.0, < 11.4.0 | 11.4.0 |
| GHSA-cjhr-43r9-cfmw pnpm binds unscoped user-level npm auth credentials to a repository-selected registry |
Medium EPSS 0.44% |
>= 11.0.0, < 11.4.0 | 11.4.0 |
| GHSA-cjhr-43r9-cfmw pnpm binds unscoped user-level npm auth credentials to a repository-selected registry |
Medium EPSS 0.44% |
< 10.34.0 | 10.34.0 |
| GHSA-hwx4-2j3j-g496 pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement |
High EPSS 0.53% |
< 10.34.0 | 10.34.0 |
| GHSA-hwx4-2j3j-g496 pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement |
High EPSS 0.53% |
>= 11.0.0, < 11.4.0 | 11.4.0 |
| GHSA-rxhj-4m44-96r4 pnpm Vulnerable to Arbitrary File Write/Delete via Malicious Patch File (Path Traversal) |
High EPSS 0.43% |
>= 11.0.0, < 11.4.0 | 11.4.0 |
| GHSA-rxhj-4m44-96r4 pnpm Vulnerable to Arbitrary File Write/Delete via Malicious Patch File (Path Traversal) |
High EPSS 0.43% |
< 10.34.0 | 10.34.0 |
| GHSA-p4xf-rf54-rj3x pnpm: Git Fetch Argument Injection via Lockfile resolution.commit |
High EPSS 0.32% |
>= 11.0.0, < 11.4.0 | 11.4.0 |
| GHSA-p4xf-rf54-rj3x pnpm: Git Fetch Argument Injection via Lockfile resolution.commit |
High EPSS 0.32% |
< 10.34.0 | 10.34.0 |
| GHSA-hg3w-7f8c-63hp pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile |
High EPSS 0.17% |
< 10.33.4 | 10.33.4 |
| GHSA-hg3w-7f8c-63hp pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile |
High EPSS 0.17% |
>= 11.0.0, < 11.0.7 | 11.0.7 |
| GHSA-v253-rj99-jwpq pnpm has Path Traversal via arbitrary file permission modification |
Medium EPSS 0.27% |
< 10.28.2 | 10.28.2 |
| GHSA-6pfh-p556-v868 pnpm: Binary ZIP extraction allows arbitrary file write via path traversal (Zip Slip) |
Medium EPSS 0.45% |
< 10.28.1 | 10.28.1 |
| GHSA-6x96-7vc8-cm3p pnpm has Windows-specific tarball Path Traversal |
Medium EPSS 0.48% |
< 10.28.1 | 10.28.1 |
| GHSA-xpqm-wm3m-f34h pnpm scoped bin name Path Traversal allows arbitrary file creation outside node_modules/.bin |
Medium EPSS 0.50% |
< 10.28.1 | 10.28.1 |
| GHSA-m733-5w8f-5ggw pnpm has symlink traversal in file:/git dependencies |
Medium EPSS 0.52% |
< 10.28.2 | 10.28.2 |
| GHSA-379q-355j-w6rj pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default" |
Critical EPSS 1.01% |
>= 10.0.0, < 10.26.0 | 10.26.0 |
| GHSA-7vhp-vf5g-r2fw pnpm Has Lockfile Integrity Bypass that Allows Remote Dynamic Dependencies |
High EPSS 0.47% |
< 10.26.0 | 10.26.0 |
| GHSA-2phv-j68v-wwqx pnpm vulnerable to Command Injection via environment variable substitution |
High EPSS 1.04% |
>= 6.25.0, < 10.27.0 | 10.27.0 |
| GHSA-8cc4-rfj6-fhg4 pnpm uses the md5 path shortening function causes packet paths to coincide, which causes indirect packet overwriting |
Medium EPSS 0.24% |
< 10.0.0 | 10.0.0 |
| GHSA-vm32-9rqf-rh3r pnpm no-script global cache poisoning via overrides / `ignore-scripts` evasion |
Critical EPSS 0.98% |
< 9.15.0 | 9.15.0 |
| GHSA-5r98-f33j-g8h7 pnpm incorrectly parses tar archives relative to specification |
Critical EPSS 1.20% |
>= 8.0.0, < 8.6.8 | 8.6.8 |
| GHSA-5r98-f33j-g8h7 pnpm incorrectly parses tar archives relative to specification |
Critical EPSS 1.20% |
< 7.33.4 | 7.33.4 |
| GHSA-9m87-6fj3-c5xh Untrusted Search Path in PNPM |
High EPSS 1.59% |
< 6.15.1 | 6.15.1 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor