Packages / pnpm / Security

ModerateVulnerabilityGHSA-xpqm-wm3m-f34hPublished 26 Jan 2026

pnpm scoped bin name Path Traversal allows arbitrary file creation outside node_modules/.bin

Affected · pnpm

  • < 10.28.1

Fixed in

10.28.1

npm install pnpm@10.28.1

  1. Affected

    0.0.1 – 10.28.0

    920 releases

  2. Fixed

    10.28.1 – 12.14.0

    110 releases, latest

1030 stable releases of pnpm, oldest to newest.

What happens

The full text is not stored yet. Read it on osv.dev.