PT-2026-4824 · Pnpm · Pnpm

Mldangelo · Published 2026-01-16 · Updated 2026-01-27 · CVE-2026-23889

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions pnpm versions prior to 10.28.1

Description A path traversal flaw exists in pnpm's tarball extraction process on Windows systems. The vulnerability stems from incomplete path normalization, specifically failing to account for . in addition to ./ when validating file paths. This allows malicious packages to write files outside of their intended package directory by leveraging backslashes as directory separators, which are recognized by Windows. A proof-of-concept demonstrates the ability to overwrite files such as .npmrc and build configurations. This issue specifically impacts Windows pnpm users and Windows CI/CD pipelines, including GitHub Actions Windows runners and Azure DevOps. The vulnerability is located in the path normalization logic within store/cafs/src/parseTarball.ts and the platform-dependent behavior in fs/indexed-pkg-importer/src/importIndexedDir.ts.

Recommendations Versions prior to 10.28.1 should be updated to version 10.28.1 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2026-01030

CVE-2026-23889

GHSA-6X96-7VC8-CM3P

Affected Products

Pnpm

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23889.json · Exploit
• https://github.com/pnpm/pnpm/commit/6ca07ffbe6fc0e8b8cdc968f228903ba0886f7c0 · Patch
• https://github.com/pnpm/pnpm/releases/tag/v10.28.1 · Patch
• https://github.com/pnpm/pnpm/security/advisories/GHSA-6x96-7vc8-cm3p · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-6x96-7vc8-cm3p · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-23889 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-01030 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-23889 · Security Note
• https://github.com/pnpm/pnpm · Note
• https://t.me/CVEtracker/43016 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2015956730262229273 · Twitter Post
• https://twitter.com/_cvereports/status/2016023526055051421 · Twitter Post
• https://twitter.com/CVEnew/status/2015912842449277243 · Twitter Post