CVE-2026-23889: pnpm Windows-specific tarball path traversal

CVE-2026-23889 · Severity: low · CVSS 3.1 · Published 2026-01-26

pnpm is a package manager for Node.js projects that downloads and extracts packages from the registry. On Windows systems, a malicious package can exploit incomplete path validation to write files outside the intended package directory, potentially overwriting critical configuration files like .npmrc or build scripts. This could allow attackers to redirect package downloads to malicious registries or inject malicious code into a project build.

Technologies: pnpm (npm). Vendors: npm.

Quick answers

Is CVE-2026-23889 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-23889 being exploited in the wild.
How severe is CVE-2026-23889?
Low severity, with a CVSS score of 3.1, published 26 January 2026.
Which products and versions are affected?
pnpm (npm) SEMVER:introduced=0,fixed=10.28.1.
Is there a fix for CVE-2026-23889?
Yes. pnpm (npm): upgrade to 10.28.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-23889 attacked?
It is attacked over the network.
Am I affected by CVE-2026-23889?
Check whether you run pnpm (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • pnpm (npm): upgrade to 10.28.1 or later
    npm install pnpm@10.28.1

Technical details

The vulnerability is a path traversal flaw in tarball extraction affecting only Windows. pnpm's path normalization in store/cafs/src/parseTarball.ts checks only for forward-slash traversal patterns (./), but fails to check for backslash patterns (\) used as directory separators on Windows. An attacker can craft a malicious tarball with entries like "package/foo\..\..\.npmrc" that bypass the check and allow writing to parent directories. The flaw requires user interaction (running pnpm install) and network access to host or reference the malicious tarball, but does not require authentication. An attacker can overwrite .npmrc, configuration files, or other executables. The vulnerability is fixed in pnpm version 10.28.1 and later.

Affected products

  • pnpm pnpm <=10.28.0

Identifiers

  • CVE-2026-23889
  • GHSA-6x96-7vc8-cm3p

Timeline

  • 2026-01-26: disclosed
  • 2026-01-26: patched: fixed in version 10.28.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.