Directory Traversal Vulnerability in pnpm Package Manager

CVE-2026-24131

What is CVE-2026-24131?

The pnpm package manager, prior to version 10.28.2, is susceptible to a directory traversal vulnerability due to the improper use of 'path.join()' when processing the directories.bin field. This flaw allows a malicious npm package to manipulate the 'directories' property to escape the package directory by specifying paths like '../../../../tmp', potentially enabling unauthorized access and modification of files at arbitrary locations within the system. This issue predominantly affects Unix, Linux, and macOS environments, while Windows users remain unaffected due to environmental constraints related to executable file handling. Mitigation is provided in version 10.28.2, which contains critical patches addressing these vulnerabilities.

References