Security

Report a vulnerability

SECURITY.md

Security Policy

Supported Versions

Version	Supported
9.x	✅
8.x	✅ till 2025 April 30
<= 7.x	❌

Reporting a Vulnerability

Send and email to security@pnpm.io

No-script global cache poisoning via overrides / `ignore-scripts` evasion
GHSA-vm32-9rqf-rh3r published Dec 10, 2024 by zkochan

Moderate
pnpm incorrectly parses tar archives relative to specification
GHSA-5r98-f33j-g8h7 published Aug 1, 2023 by zkochan

High

Learn more about advisories related to pnpm/pnpm in the GitHub Advisory Database