CVE-2026-23890: Pnpm Path Traversal Vulnerability
MODERATECVE-2026-23890 is a MODERATE (CVSS 6.5) path traversal vulnerability (CWE-23: Relative Path Traversal) affecting Pnpm libraries in the npm ecosystem. The issue involves pnpm scoped bin name path traversal allows arbitrary file creation outside node_modules/.bin. Remediation is available by upgrading affected packages to version 10.28.1.
CVE-2026-23890 at a Glance
Security Impact
CVSS: 6.5
The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N).
How to Fix CVE-2026-23890
To remediate this vulnerability, upgrade all affected Pnpm dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
npm install pnpm@10.28.1Run the following command in your project directory to verify that all resolved dependencies use the patched release:
npm ls pnpmHow to Check if You Are Affected
To determine whether your Node.js application is affected by CVE-2026-23890, inspect your project dependencies using npm:
npm ls pnpmAnalyze the terminal output to locate any version of Pnpm in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 10.28.1), your application is affected.
Note: The npm ls pnpm command inspects dependencies declared in your package.json and lockfile; it does not perform automated runtime dynamic scanning.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-23: Relative Path Traversal, where the product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory. In Pnpm, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-23890 Affected Pnpm Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
pnpm
|
npm |
< 10.28.1
|
10.28.1
|
References
Frequently Asked Questions
What is CVE-2026-23890?
Which Pnpm versions are affected?
What version fixes CVE-2026-23890?
Is pnpm affected?
What is the CVSS score of CVE-2026-23890?
What CWE is associated with CVE-2026-23890?
How can I check npm dependencies for CVE-2026-23890?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-xpqm-wm3m-f34h",
"modified" : "2026-01-29T03:23:11Z",
"published" : "2026-01-26T21:02:39Z",
"aliases" : [ "CVE-2026-23890" ],
"summary" : "pnpm scoped bin name Path Traversal allows arbitrary file creation outside node_modules/.bin",
"details" : "### Summary\nA path traversal vulnerability in pnpm's bin linking allows malicious npm packages to create executable shims or symlinks outside of `node_modules/.bin`. Bin names starting with `@` bypass validation, and after scope normalization, path traversal sequences like `../../` remain intact.\n\n### Details\nThe vulnerability exists in the bin name validation and normalization logic:\n\n**1. Validation Bypass (`pkg-manager/package-bins/src/index.ts`)**\n\nThe filter allows any bin name starting with `@` to pass through without validation:\n\n```typescript\n.filter((commandName) =>\n encodeURIComponent(commandName) === commandName ||\n commandName === '' ||\n commandName[0] === '@' // <-- Bypasses validation\n)\n```\n\n**2. Incomplete Normalization (`pkg-manager/package-bins/src/index.ts`)**\n\n```typescript\nfunction normalizeBinName (name: string): string {\n return name[0] === '@' ? name.slice(name.indexOf('/') + 1) : name\n}\n// Input: @scope/../../evil\n// Output: ../../evil <-- Path traversal preserved!\n```\n\n**3. Exploitation (`pkg-manager/link-bins/src/index.ts:288`)**\n\nThe normalized name is used directly in `path.join()` without validation.\n\n### PoC\n1. Create a malicious package:\n```json\n{\n \"name\": \"malicious-pkg\",\n \"version\": \"1.0.0\",\n \"bin\": {\n \"@scope/../../.npmrc\": \"./malicious.js\"\n }\n}\n```\n\n2. Install the package:\n```bash\npnpm add /path/to/malicious-pkg\n```\n\n3. Observe `.npmrc` created in project root (outside node_modules/.bin).\n\n### Impact\n- All pnpm users who install npm packages\n- CI/CD pipelines using pnpm\n- Can overwrite config files, scripts, or other sensitive files\n\nVerified on pnpm main @ commit 5a0ed1d45.",
"severity" : [ {
"type" : "CVSS_V3",
"score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "npm",
"name" : "pnpm"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "10.28.1"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/pnpm/pnpm/security/advisories/GHSA-xpqm-wm3m-f34h"
}, {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-23890"
}, {
"type" : "WEB",
"url" : "https://github.com/pnpm/pnpm/commit/8afbb1598445d37985d91fda18abb4795ae5062d"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/pnpm/pnpm"
}, {
"type" : "WEB",
"url" : "https://github.com/pnpm/pnpm/releases/tag/v10.28.1"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-23" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2026-01-26T21:02:39Z",
"nvd_published_at" : "2026-01-26T22:15:56Z"
}
}