Packages / pnpm / Security

ModerateVulnerabilityGHSA-v253-rj99-jwpqPublished 26 Jan 2026

pnpm has Path Traversal via arbitrary file permission modification

Affected · pnpm

  • < 10.28.2

Fixed in

10.28.2

npm install pnpm@10.28.2

  1. Affected

    0.0.1 – 10.28.1

    921 releases

  2. Fixed

    10.28.2 – 12.14.0

    109 releases, latest

1030 stable releases of pnpm, oldest to newest.

What happens

The full text is not stored yet. Read it on osv.dev.