Packages / pnpm / Security

HighVulnerabilityGHSA-qrv3-253h-g69cPublished 27 Jun 2026

pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config

Affected · pnpm

  • < 10.34.4
  • >= 11.0.0, < 11.8.0

Fixed in

11.8.0

npm install pnpm@11.8.0

  1. Affected

    0.0.1 – 10.34.3

    941 releases

  2. Fixed

    10.34.4 – 10.34.7

    4 releases

  3. Affected

    11.0.0 – 11.7.0

    25 releases

  4. Fixed

    11.8.0 – 12.14.0

    60 releases, latest

1030 stable releases of pnpm, oldest to newest.

What happens

The full text is not stored yet. Read it on osv.dev.