Security Advisories for pnpm in npm
High
about 2 months ago
pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config
npm
pnpm
High
about 2 months ago
pnpm: `patch-remove` could delete project-selected files outside the patches directory
npm
pnpm
High
about 2 months ago
pnpm: `stage download` writes outside its destination directory via manifest name/version traversal
npm
pnpm
High
about 2 months ago
pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes
npm
pnpm
High
about 2 months ago
pnpm: Repository-controlled configDependencies can select a pacquet native install engine
npm
pnpm
High
about 2 months ago
pnpm: Manifest identity spoof satisfies allowBuilds and runs attacker lifecycle
npm
pnpm
Moderate
about 2 months ago
pnpm: Repository config can expand victim environment secrets into registry requests before scripts run
npm
pnpm
High
about 2 months ago
pnpm Vulnerable to Arbitrary File Write/Delete via Malicious Patch File (Path Traversal)
npm
pnpm
Moderate
about 2 months ago
pnpm binds unscoped user-level npm auth credentials to a repository-selected registry
npm
pnpm
High
about 2 months ago
pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement
npm
pnpm
Moderate
about 2 months ago
pnpm: Git Fetch Argument Injection via Lockfile resolution.commit
npm
pnpm
Moderate
about 2 months ago
pnpm Has an Integrity Check Bypass via Missing Lockfile Integrity Field
npm
pnpm
Moderate
about 2 months ago
pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile
npm
pnpm
Moderate
7 months ago
pnpm: Binary ZIP extraction allows arbitrary file write via path traversal (Zip Slip)
npm
pnpm
Moderate
7 months ago
pnpm scoped bin name Path Traversal allows arbitrary file creation outside node_modules/.bin
npm
pnpm
High
7 months ago
pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default"
npm
pnpm
High
7 months ago
pnpm Has Lockfile Integrity Bypass that Allows Remote Dynamic Dependencies
npm
pnpm
High
7 months ago
pnpm vulnerable to Command Injection via environment variable substitution
npm
pnpm
Moderate
over 1 year ago
pnpm uses the md5 path shortening function causes packet paths to coincide, which causes indirect packet overwriting
npm
pnpm
Moderate
over 1 year ago
pnpm no-script global cache poisoning via overrides / `ignore-scripts` evasion
npm
pnpm
High
about 3 years ago
pnpm incorrectly parses tar archives relative to specification
npm
@pnpm/win-x64, @pnpm/macos-x64, @pnpm/macos-arm64, @pnpm/linuxstatic-arm64, @pnpm/linux-x64, @pnpm/linux-arm64, @pnpm/exe, pnpm, @pnpm/cafs