Packages / pnpm / Security

HighVulnerabilityGHSA-v23m-ccfg-pq9hPublished 26 Jun 2026

pnpm: `stage download` writes outside its destination directory via manifest name/version traversal

Affected · pnpm

  • >= 11.3.0, < 11.5.3

Fixed in

11.5.3

npm install pnpm@11.5.3

  1. Not affected

    0.0.1 – 11.2.2

    962 releases

  2. Affected

    11.3.0 – 11.5.2

    5 releases

  3. Fixed

    11.5.3 – 12.14.0

    63 releases, latest

1030 stable releases of pnpm, oldest to newest.

What happens

The full text is not stored yet. Read it on osv.dev.