{"id":"CVE-2026-23890","aliases":["ALPINE-CVE-2026-23890","EUVD-2026-4656","GHSA-xpqm-wm3m-f34h"],"status":"published","title":"pnpm scoped bin name Path Traversal allows arbitrary file creation outside node_modules/.bin","description":"pnpm is a package manager. Prior to version 10.28.1, a path traversal vulnerability in pnpm's bin linking allows malicious npm packages to create executable shims or symlinks outside of `node_modules/.bin`. Bin names starting with `@` bypass validation, and after scope normalization, path traversal sequences like `../../` remain intact. This issue affects all pnpm users who install npm packages and CI/CD pipelines using pnpm. It can lead to overwriting config files, scripts, or other sensitive files. Version 10.28.1 contains a patch.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00498,"percentile":0.43157,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-23"],"published":"2026-01-26T21:02:39Z","modified":"2026-11-03T06:33:01Z","fixes":[{"ecosystem":"npm","package":"pnpm","fixed_in":["10.28.1"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.23","package":"pnpm","fixed_in":["10.33.4-r0"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"pnpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.28.1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"pnpm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.33.4-r0"}]}]},{"source":"osv","ecosystem":"npm","package":"pnpm","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"10.28.1"}]}]}],"products":[{"vendor":"pnpm","product":"pnpm"}],"references":[{"url":"https://github.com/pnpm/pnpm/security/advisories/GHSA-xpqm-wm3m-f34h","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/pnpm/pnpm/commit/8afbb1598445d37985d91fda18abb4795ae5062d","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/pnpm/pnpm/releases/tag/v10.28.1","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23890","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xpqm-wm3m-f34h"},{"url":"https://security.alpinelinux.org/vuln/CVE-2026-23890","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23890.json","tags":["advisory"]},{"url":"https://github.com/pnpm/pnpm","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-23890","title":"pnpm scoped bin name Path Traversal allows arbitrary file creation outside node_modules/.bin","description":"pnpm is a package manager. Prior to version 10.28.1, a path traversal vulnerability in pnpm's bin linking allows malicious npm packages to create executable shims or symlinks outside of `node_modules/.bin`. Bin names starting with `@` bypass validation, and after scope normalization, path traversal sequences like `../../` remain intact. This issue affects all pnpm users who install npm packages and CI/CD pipelines using pnpm. It can lead to overwriting config files, scripts, or other sensitive files. Version 10.28.1 contains a patch.","status":"published","published":"2026-01-26T21:53:40.81Z","modified":"2026-01-27T21:39:57.954Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-23"],"updated_at":"2026-11-02T13:42:15.603999Z"}],"euvd":[{"id":"EUVD-2026-4656","description":"pnpm is a package manager. Prior to version 10.28.1, a path traversal vulnerability in pnpm's bin linking allows malicious npm packages to create executable shims or symlinks outside of `node_modules/.bin`. Bin names starting with `@` bypass validation, and after scope normalization, path traversal sequences like `../../` remain intact. This issue affects all pnpm users who install npm packages and CI/CD pipelines using pnpm. It can lead to overwriting config files, scripts, or other sensitive files. Version 10.28.1 contains a patch.","status":"published","published":"2026-01-26T21:53:40Z","modified":"2026-01-27T21:39:57Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T19:48:46.818498Z"}],"ghsa":[{"id":"GHSA-xpqm-wm3m-f34h","title":"pnpm scoped bin name Path Traversal allows arbitrary file creation outside node_modules/.bin","description":"### Summary\nA path traversal vulnerability in pnpm's bin linking allows malicious npm packages to create executable shims or symlinks outside of `node_modules/.bin`. Bin names starting with `@` bypass validation, and after scope normalization, path traversal sequences like `../../` remain intact.\n\n### Details\nThe vulnerability exists in the bin name validation and normalization logic:\n\n**1. Validation Bypass (`pkg-manager/package-bins/src/index.ts`)**\n\nThe filter allows any bin name starting with `@` to pass through without validation:\n\n```typescript\n.filter((commandName) =\u003e\n  encodeURIComponent(commandName) === commandName ||\n  commandName === '' ||\n  commandName[0] === '@'  // \u003c-- Bypasses validation\n)\n```\n\n**2. Incomplete Normalization (`pkg-manager/package-bins/src/index.ts`)**\n\n```typescript\nfunction normalizeBinName (name: string): string {\n  return name[0] === '@' ? name.slice(name.indexOf('/') + 1) : name\n}\n// Input:  @scope/../../evil\n// Output: ../../evil  \u003c-- Path traversal preserved!\n```\n\n**3. Exploitation (`pkg-manager/link-bins/src/index.ts:288`)**\n\nThe normalized name is used directly in `path.join()` without validation.\n\n### PoC\n1. Create a malicious package:\n```json\n{\n  \"name\": \"malicious-pkg\",\n  \"version\": \"1.0.0\",\n  \"bin\": {\n    \"@scope/../../.npmrc\": \"./malicious.js\"\n  }\n}\n```\n\n2. Install the package:\n```bash\npnpm add /path/to/malicious-pkg\n```\n\n3. Observe `.npmrc` created in project root (outside node_modules/.bin).\n\n### Impact\n- All pnpm users who install npm packages\n- CI/CD pipelines using pnpm\n- Can overwrite config files, scripts, or other sensitive files\n\nVerified on pnpm main @ commit 5a0ed1d45.","status":"published","published":"2026-01-26T21:02:39Z","modified":"2026-01-29T03:23:11Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-23"],"updated_at":"2026-11-02T14:39:20.563096Z"}],"nvd":[{"id":"CVE-2026-23890","description":"pnpm is a package manager. Prior to version 10.28.1, a path traversal vulnerability in pnpm's bin linking allows malicious npm packages to create executable shims or symlinks outside of `node_modules/.bin`. Bin names starting with `@` bypass validation, and after scope normalization, path traversal sequences like `../../` remain intact. This issue affects all pnpm users who install npm packages and CI/CD pipelines using pnpm. It can lead to overwriting config files, scripts, or other sensitive files. Version 10.28.1 contains a patch.","status":"published","published":"2026-01-26T22:15:56.363Z","modified":"2026-06-17T10:22:15.927Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-23"],"updated_at":"2026-11-02T14:12:04.769088Z"}],"osv":[{"id":"ALPINE-CVE-2026-23890","description":"pnpm is a package manager. Prior to version 10.28.1, a path traversal vulnerability in pnpm's bin linking allows malicious npm packages to create executable shims or symlinks outside of `node_modules/.bin`. Bin names starting with `@` bypass validation, and after scope normalization, path traversal sequences like `../../` remain intact. This issue affects all pnpm users who install npm packages and CI/CD pipelines using pnpm. It can lead to overwriting config files, scripts, or other sensitive files. Version 10.28.1 contains a patch.","status":"published","published":"2026-01-26T22:15:56.363Z","modified":"2026-11-03T06:33:01.760911692Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-03T07:15:53.944853Z"},{"id":"CVE-2026-23890","title":"pnpm scoped bin name Path Traversal allows arbitrary file creation outside node_modules/.bin","description":"pnpm is a package manager. Prior to version 10.28.1, a path traversal vulnerability in pnpm's bin linking allows malicious npm packages to create executable shims or symlinks outside of `node_modules/.bin`. Bin names starting with `@` bypass validation, and after scope normalization, path traversal sequences like `../../` remain intact. This issue affects all pnpm users who install npm packages and CI/CD pipelines using pnpm. It can lead to overwriting config files, scripts, or other sensitive files. Version 10.28.1 contains a patch.","status":"published","published":"2026-01-26T21:53:40.81Z","modified":"2026-10-28T02:30:50.396676061Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-23"],"updated_at":"2026-11-02T15:44:59.079784Z"},{"id":"GHSA-xpqm-wm3m-f34h","title":"pnpm scoped bin name Path Traversal allows arbitrary file creation outside node_modules/.bin","description":"### Summary\nA path traversal vulnerability in pnpm's bin linking allows malicious npm packages to create executable shims or symlinks outside of `node_modules/.bin`. Bin names starting with `@` bypass validation, and after scope normalization, path traversal sequences like `../../` remain intact.\n\n### Details\nThe vulnerability exists in the bin name validation and normalization logic:\n\n**1. Validation Bypass (`pkg-manager/package-bins/src/index.ts`)**\n\nThe filter allows any bin name starting with `@` to pass through without validation:\n\n```typescript\n.filter((commandName) =\u003e\n  encodeURIComponent(commandName) === commandName ||\n  commandName === '' ||\n  commandName[0] === '@'  // \u003c-- Bypasses validation\n)\n```\n\n**2. Incomplete Normalization (`pkg-manager/package-bins/src/index.ts`)**\n\n```typescript\nfunction normalizeBinName (name: string): string {\n  return name[0] === '@' ? name.slice(name.indexOf('/') + 1) : name\n}\n// Input:  @scope/../../evil\n// Output: ../../evil  \u003c-- Path traversal preserved!\n```\n\n**3. Exploitation (`pkg-manager/link-bins/src/index.ts:288`)**\n\nThe normalized name is used directly in `path.join()` without validation.\n\n### PoC\n1. Create a malicious package:\n```json\n{\n  \"name\": \"malicious-pkg\",\n  \"version\": \"1.0.0\",\n  \"bin\": {\n    \"@scope/../../.npmrc\": \"./malicious.js\"\n  }\n}\n```\n\n2. Install the package:\n```bash\npnpm add /path/to/malicious-pkg\n```\n\n3. Observe `.npmrc` created in project root (outside node_modules/.bin).\n\n### Impact\n- All pnpm users who install npm packages\n- CI/CD pipelines using pnpm\n- Can overwrite config files, scripts, or other sensitive files\n\nVerified on pnpm main @ commit 5a0ed1d45.","status":"published","published":"2026-01-26T21:02:39Z","modified":"2026-02-03T03:06:15.209571Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-23"],"updated_at":"2026-11-02T15:47:00.198893Z"}]}}