npm/pnpm: high 7.1
pnpm: pacquet trust-lockfile install can create dependency symlinks outside the project
Action: Upgrade pnpm to 12.0.0-alpha.5 or later.
npm i pnpm@12.0.0-alpha.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 12.0.0-alpha.0 | 12.0.0-alpha.5 | - |
Fixed versions
| 12.0.0-alpha.5 |
Sources
- osv: GHSA-2rx9-3g3h-c2jv
- https://github.com/pnpm/pnpm/security/advisories/GHSA-2rx9-3g3h-c2jv
- https://github.com/pnpm/pnpm/pull/12872
- https://github.com/pnpm/pnpm/commit/51300fd41c5e4c8f47635108e373cc3d1f324fa7
- https://github.com/pnpm/pnpm
published · modified · JSON