Packages / pnpm / Security

ModerateVulnerabilityGHSA-4gxm-v5v7-fqc4Published 26 Jun 2026

pnpm: Reserved bin name deletes PNPM_HOME during global remove

Affected · pnpm

  • < 10.34.2
  • >= 11.0.0, < 11.5.3

Fixed in

11.5.3

npm install pnpm@11.5.3

  1. Affected

    0.0.1 – 10.34.1

    939 releases

  2. Fixed

    10.34.2 – 10.34.7

    6 releases

  3. Affected

    11.0.0 – 11.5.2

    22 releases

  4. Fixed

    11.5.3 – 12.14.0

    63 releases, latest

1030 stable releases of pnpm, oldest to newest.

What happens

The full text is not stored yet. Read it on osv.dev.