Path Traversal Vulnerability in pnpm by Zoka

CVE-2026-23888

What is CVE-2026-23888?

A path traversal vulnerability in pnpm prior to version 10.28.1 can allow malicious packages to write files outside their intended extraction directory. Attackers can exploit this vulnerability through manipulated ZIP entries that contain ../ or absolute paths, escaping the root directory during file extraction. Additionally, the BinaryResolution.prefix field can be leveraged to concatenate crafted prefixes like ../../evil, redirecting extracted files outside the designated target directory. This puts users who install packages with binary assets, customize Node.js binary locations, or utilize CI/CD pipelines at risk, potentially leading to the overwriting of critical configuration files, scripts, or other sensitive information.

References