| Version | Supported |
|---|---|
| 10.x | ✅ |
| 9.x | ✅ till 2026 April 30 |
| <= 8.x | ❌ |
Submit your findings here: https://github.com/pnpm/pnpm/security/advisories
We do not operate a bounty program.
Security: pnpm/pnpm
Security
SECURITY.md
-
No-script global cache poisoning via overrides / `ignore-scripts` evasionGHSA-vm32-9rqf-rh3r published
Dec 10, 2024 by zkochanModerate -
The md5 path shortening function causes packet paths to coincide, which causes indirect packet overwritingGHSA-8cc4-rfj6-fhg4 published
Apr 23, 2025 by zkochanModerate -
pnpm incorrectly parses tar archives relative to specificationGHSA-5r98-f33j-g8h7 published
Aug 1, 2023 by zkochanHigh
Learn more about advisories related to pnpm/pnpm in the GitHub Advisory Database