{"action":"Upgrade pnpm to 9.15.0 or later.","affected":[{"fixed":"9.15.0","introduced":"0"}],"component":"pnpm","cve_ids":["CVE-2024-53866"],"ecosystem":"npm","epss":0.00977,"exploited":false,"fixed_versions":["9.15.0"],"ghsa_id":"GHSA-vm32-9rqf-rh3r","id":"tcs_01M5KGC7WE9M18V04PYP45K3N9","modified_at":"2026-09-10T03:50:56.176430870Z","published_at":"2024-12-10T22:42:41Z","references":["https://osv.dev/vulnerability/GHSA-vm32-9rqf-rh3r","https://github.com/pnpm/pnpm/security/advisories/GHSA-vm32-9rqf-rh3r","https://nvd.nist.gov/vuln/detail/CVE-2024-53866","https://github.com/pnpm/pnpm/commit/11afcddea48f25ed5117a87dc1780a55222b9743","https://github.com/pnpm/pnpm"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-vm32-9rqf-rh3r","url":"https://osv.dev/vulnerability/GHSA-vm32-9rqf-rh3r"},{"source":"nvd","source_id":"CVE-2024-53866","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-53866"}],"summary":"pnpm no-script global cache poisoning via overrides / `ignore-scripts` evasion"}