Packages / pnpm / Security

HighVulnerabilityGHSA-379q-355j-w6rjPublished 7 Jan 2026

pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default"

Affected · pnpm

  • >= 10.0.0, < 10.26.0

Fixed in

10.26.0

npm install pnpm@10.26.0

  1. Not affected

    0.0.1 – 9.15.9

    866 releases

  2. Affected

    10.0.0 – 10.25.0

    49 releases

  3. Fixed

    10.26.0 – 12.14.0

    115 releases, latest

1030 stable releases of pnpm, oldest to newest.

What happens

The full text is not stored yet. Read it on osv.dev.