[GHSA-6pfh-p556-v868] pnpm: Binary ZIP extraction allows arbitrary file write via path traversal (Zip Slip)

[mgol]

Updates

• Affected products

Comments
See GHSA-6pfh-p556-v868. The issue is fixed in pnpm 10.28.1 and currently this advisory flags all versions older than 11.0.0-alpha.3 which means all stable versions of pnpm are flagged.

[github]

Hi there @zkochan! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[mgol]

If the goal was to flag all 11.x versions older than 11.0.0-alpha.3 then the range should not be < 11.0.0-alpha.3, but >= 11.0.0-alpha.0 < 11.0.0-alpha.3 or something similar.

[Copilot]

Pull request overview

This PR updates the security advisory for GHSA-6pfh-p556-v868 to correctly specify the fixed version range for the pnpm Zip Slip vulnerability. The change ensures that only versions prior to 10.28.1 are flagged as vulnerable, rather than all stable versions.

Changes:

• Updated the fixed version specification from 11.0.0-alpha.3 to >=10.28.1
• Added database-specific metadata to document the last known affected version range

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The 'fixed' field should contain a single version number, not a version range with comparison operators. The value should be '10.28.1' without the '>=' prefix, as the field semantically indicates 'fixed in version X and later'.

Suggested change

	"fixed": ">=10.28.1"
	"fixed": "10.28.1"

[zkochan]

I don't understand where 11.0.0-alpha.3 is coming from. In the advisory I only specified this:

Affected versions
<= 10.28.0
Patched versions
>=10.28.1

No mention of 11.0.0-alpha.3