Path Traversal Vulnerability in pnpm Package Manager by pnpm

CVE-2026-23890

What is CVE-2026-23890?

A path traversal vulnerability exists in pnpm's bin linking functionality that allows malicious npm packages to create executable shims or symlinks outside the intended node_modules/.bin directory. This flaw occurs because bin names beginning with @ can bypass initial validation checks. As a result, path traversal sequences such as ../../ can lead to the overwriting of critical configuration files, scripts, or other sensitive data on the system. Users and CI/CD pipelines utilizing pnpm before version 10.28.1 are at risk. Version 10.28.1 includes a patch to mitigate this issue.

References