Packages / pnpm / Security

ModerateVulnerabilityGHSA-m733-5w8f-5ggwPublished 26 Jan 2026

pnpm has symlink traversal in file:/git dependencies

Affected · pnpm

  • < 10.28.2

Fixed in

10.28.2

npm install pnpm@10.28.2

  1. Affected

    0.0.1 – 10.28.1

    921 releases

  2. Fixed

    10.28.2 – 12.14.0

    109 releases, latest

1030 stable releases of pnpm, oldest to newest.

What happens

The full text is not stored yet. Read it on osv.dev.