CVE-2026-23890: Pnpm Path Traversal Vulnerability

CVE-2026-23890 Overview

CVE-2026-23890 is a path traversal vulnerability in pnpm, a popular Node.js package manager. The vulnerability exists in pnpm's bin linking functionality, which allows malicious npm packages to create executable shims or symlinks outside of the intended node_modules/.bin directory. Bin names starting with @ bypass validation, and after scope normalization, path traversal sequences like ../../ remain intact, enabling attackers to write files to arbitrary locations.

Critical Impact

Malicious npm packages can overwrite configuration files, scripts, or other sensitive files on systems running vulnerable pnpm versions, potentially leading to supply chain attacks in CI/CD pipelines.

Affected Products

• pnpm versions prior to 10.28.1
• All pnpm users who install npm packages
• CI/CD pipelines using pnpm for dependency management

Discovery Timeline

• 2026-01-26 - CVE-2026-23890 published to NVD
• 2026-01-28 - Last updated in NVD database

Technical Details for CVE-2026-23890

Vulnerability Analysis

This path traversal vulnerability (CWE-23) exists in pnpm's bin linking mechanism, which is responsible for creating executable shims in the node_modules/.bin directory when installing packages. The flaw allows attackers to craft malicious package manifests that can write files outside the intended bin directory.

The vulnerability can be exploited without authentication through network-based attacks, though user interaction is required (the victim must install a malicious package). Successful exploitation results in high impact to system integrity, as attackers can overwrite arbitrary files within the permissions of the running user.

Root Cause

The root cause lies in insufficient input validation of bin names in package manifests. Specifically, bin names starting with @ (typically used for scoped packages) were allowed to bypass validation. After the scope normalization process strips the @scope/ prefix, any path traversal sequences like ../../ embedded in the bin name remain intact, allowing the constructed path to escape the node_modules/.bin directory.

Attack Vector

An attacker can exploit this vulnerability by publishing a malicious npm package with a specially crafted bin field in its package.json. When a victim installs this package using a vulnerable version of pnpm, the path traversal sequences in the bin name cause pnpm to create symlinks or shims outside the expected directory structure, potentially overwriting sensitive files such as configuration files, shell scripts, or other project files.

// Security patch from pkg-manager/package-bins/src/index.ts
// Before: Insufficient validation allowed path traversal via @ prefix
// After: Validates bin names and ensures bin paths are subdirectories of package path

function commandsFromBin (bin: PackageBin, pkgName: string, pkgPath: string): Command[] {
  const cmds: Command[] = []
  for (const [commandName, binRelativePath] of typeof bin === 'string' ? [[pkgName, bin]] : Object.entries(bin)) {
    const binName = commandName[0] === '@'
      ? commandName.slice(commandName.indexOf('/') + 1)
      : commandName
    // Validate: must be safe (no path traversal) - only allow URL-safe chars or $
    if (binName !== encodeURIComponent(binName) && binName !== '$') {
      continue
    }
    const binPath = path.join(pkgPath, binRelativePath)
    if (!isSubdir(pkgPath, binPath)) {
      continue
    }
    cmds.push({ name: binName, path: binPath })
  }
  // ... rest of function
}

Source: GitHub Commit

Detection Methods for CVE-2026-23890

Indicators of Compromise

• Unexpected files or symlinks appearing outside node_modules/.bin directories after package installation
• Modified configuration files (e.g., .npmrc, .env, shell scripts) with unexpected content
• Symlinks in project directories pointing to locations within node_modules
• Unusual bin entries in package.json files containing @ prefixes followed by path traversal sequences

Detection Strategies

• Audit installed packages for suspicious bin field configurations containing @ prefixes with ../ sequences
• Monitor file system changes during pnpm install operations for writes outside expected directories
• Implement package scanning in CI/CD pipelines to detect malicious manifest patterns before installation
• Review pnpm version in use and flag any versions prior to 10.28.1

Monitoring Recommendations

• Enable file integrity monitoring on critical configuration files and scripts in project directories
• Log and alert on symlink creation events outside node_modules during package manager operations
• Implement runtime security monitoring for development and CI/CD environments
• Configure SentinelOne agents to detect suspicious file write patterns during Node.js package installation processes

How to Mitigate CVE-2026-23890

Immediate Actions Required

• Upgrade pnpm to version 10.28.1 or later immediately
• Audit existing projects for any signs of compromise (unexpected files or modified configurations)
• Review recently installed packages for suspicious bin configurations
• Regenerate node_modules directories by removing them and running fresh installs with the patched version

Patch Information

pnpm version 10.28.1 contains the security fix for this vulnerability. The patch adds two critical validation checks to the commandsFromBin function:

1. Bin name validation: Ensures bin names only contain URL-safe characters (or the $ character), rejecting any names containing path traversal sequences
2. Path containment check: Uses an isSubdir() function to verify that the resolved bin path remains within the package directory

For detailed patch information, see the GitHub Security Advisory and Release Notes for v10.28.1.

Workarounds

• Use npm or yarn as alternative package managers until pnpm can be upgraded
• Implement strict package allow-listing in CI/CD pipelines to prevent installation of untrusted packages
• Run pnpm installations in isolated, containerized environments with limited write access
• Enable read-only file systems for sensitive directories during package installation operations

# Upgrade pnpm to the patched version
npm install -g pnpm@10.28.1

# Verify the installed version
pnpm --version

# Clean reinstall dependencies with patched pnpm
rm -rf node_modules
pnpm install