Description

pnpm is a package manager. Prior to version 10.28.1, a path traversal vulnerability in pnpm's tarball extraction allows malicious packages to write files outside the package directory on Windows. The path normalization only checks for `./` but not `.\`. On Windows, backslashes are directory separators, enabling path traversal. This vulnerability is Windows-only. This issue impacts Windows pnpm users and Windows CI/CD pipelines (GitHub Actions Windows runners, Azure DevOps). It can lead to overwriting `.npmrc`, build configs, or other files. Version 10.28.1 contains a patch.

INFO

Published Date :

2026-01-26T21:50:55.289Z

Last Modified :

2026-01-27T21:40:36.271Z

Source :

GitHub_M
AFFECTED PRODUCTS

The following products are affected by CVE-2026-23889 vulnerability.

Vendors Products
Microsoft
  • Windows
Pnpm
  • Pnpm
REFERENCES

Here, you will find a curated list of external links that provide in-depth information to CVE-2026-23889.

URL Resource
https://github.com/pnpm/pnpm/commit/6ca07ffbe6fc0e8b8cdc968f228903ba0886f7c0 cve-icon cve-icon cve-icon
https://github.com/pnpm/pnpm/releases/tag/v10.28.1 cve-icon cve-icon cve-icon
https://github.com/pnpm/pnpm/security/advisories/GHSA-6x96-7vc8-cm3p cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-23889 cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-23889 cve-icon
Login to claim this CVE

CVSS Vulnerability Scoring System

Detailed values of each vector for above chart.
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact