pnpm vulnerable to no-script global cache poisoning via overrides / `ignore-scripts` evasion

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2024-53866 · CVE overview and exploitation status

EUVD-2024-3510

GHSA-vm32-9rqf-rh3r

cve-program · CVE-2024-53866

• https://github.com/pnpm/pnpm/security/advisories/GHSA-vm32-9rqf-rh3r
• https://github.com/pnpm/pnpm/commit/11afcddea48f25ed5117a87dc1780a55222b9743

euvd · EUVD-2024-3510

• https://github.com/pnpm/pnpm/security/advisories/GHSA-vm32-9rqf-rh3r
• https://github.com/pnpm/pnpm/commit/11afcddea48f25ed5117a87dc1780a55222b9743

nvd · CVE-2024-53866

• https://github.com/pnpm/pnpm/commit/11afcddea48f25ed5117a87dc1780a55222b9743
• https://github.com/pnpm/pnpm/security/advisories/GHSA-vm32-9rqf-rh3r

osv · GHSA-vm32-9rqf-rh3r

• https://github.com/pnpm/pnpm/security/advisories/GHSA-vm32-9rqf-rh3r
• https://nvd.nist.gov/vuln/detail/CVE-2024-53866
• https://github.com/pnpm/pnpm/commit/11afcddea48f25ed5117a87dc1780a55222b9743
• https://github.com/pnpm/pnpm

No related changes are available here.