Packages / pnpm / Security

ModerateVulnerabilityGHSA-6pfh-p556-v868Published 26 Jan 2026

pnpm: Binary ZIP extraction allows arbitrary file write via path traversal (Zip Slip)

Affected · pnpm

  • < 10.28.1

Fixed in

10.28.1

npm install pnpm@10.28.1

  1. Affected

    0.0.1 – 10.28.0

    920 releases

  2. Fixed

    10.28.1 – 12.14.0

    110 releases, latest

1030 stable releases of pnpm, oldest to newest.

What happens

The full text is not stored yet. Read it on osv.dev.