[GHSA-6pfh-p556-v868] pnpm: Binary ZIP extraction allows arbitrary file write via path traversal (Zip Slip)

[mgol]

Updates

• Affected products

Comments
See GHSA-6pfh-p556-v868. The issue is fixed in pnpm 10.28.1 and currently this advisory flags all versions older than 11.0.0-alpha.3 which means all stable versions of pnpm are flagged.

[github]

Hi there @zkochan! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[mgol]

If the goal was to flag all 11.x versions older than 11.0.0-alpha.3 then the range should not be < 11.0.0-alpha.3, but >= 11.0.0-alpha.0 < 11.0.0-alpha.3 or something similar.

[Copilot]

Pull request overview

This PR updates the security advisory for GHSA-6pfh-p556-v868 to correctly specify the fixed version range for the pnpm Zip Slip vulnerability. The change ensures that only versions prior to 10.28.1 are flagged as vulnerable, rather than all stable versions.

Changes:

• Updated the fixed version specification from 11.0.0-alpha.3 to >=10.28.1
• Added database-specific metadata to document the last known affected version range

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The 'fixed' field should contain a single version number, not a version range with comparison operators. The value should be '10.28.1' without the '>=' prefix, as the field semantically indicates 'fixed in version X and later'.

Suggested change

	"fixed": ">=10.28.1"
	"fixed": "10.28.1"

[mgol]

This makes sense, but I don't have permissions to apply this suggestion... 🤷🏻‍♂️

[zkochan]

I don't understand where 11.0.0-alpha.3 is coming from. In the advisory I only specified this:

Affected versions
<= 10.28.0
Patched versions
>=10.28.1

No mention of 11.0.0-alpha.3

[mgol]

@zkochan I am also wondering. The link to the GitHub Advisory Database version is GHSA-6pfh-p556-v868 and you can see the wrong version there. But at the bottom it says "zkochan published to pnpm/pnpm 2 days ago" and that has correct versions...

[advisory-database]

Hi @mgol! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!