HighVulnerabilityGHSA-2rx9-3g3h-c2jvPublished 1 Sept 2026
pnpm: pacquet trust-lockfile install can create dependency symlinks outside the project
Affected · pnpm
- >= 12.0.0-alpha.0, < 12.0.0-alpha.5
Fixed in
12.0.0-alpha.5
npm install pnpm@12.0.0-alpha.5What happens
The full text is not stored yet. Read it on osv.dev.