CVE-2024-53866
1 advisory.
npm/pnpm CVE-2024-53866: critical 9.8, EPSS 0.98%
pnpm no-script global cache poisoning via overrides / `ignore-scripts` evasion
Action: Upgrade pnpm to 9.15.0 or later.
npm i pnpm@9.15.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 9.15.0 | - |
Fixed versions
| 9.15.0 |
Sources
- osv: GHSA-vm32-9rqf-rh3r
- nvd: CVE-2024-53866
- https://github.com/pnpm/pnpm/security/advisories/GHSA-vm32-9rqf-rh3r
- https://github.com/pnpm/pnpm/commit/11afcddea48f25ed5117a87dc1780a55222b9743
- https://github.com/pnpm/pnpm
CVE-2024-53866 · published · modified · JSON