Executive brief
pnpm is a package manager for Node.js projects that downloads and extracts packages from the registry. On Windows systems, a malicious package can exploit incomplete path validation to write files outside the intended package directory, potentially overwriting critical configuration files like .npmrc or build scripts. This could allow attackers to redirect package downloads to malicious registries or inject malicious code into a project build.
Technical details
The vulnerability is a path traversal flaw in tarball extraction affecting only Windows. pnpm's path normalization in store/cafs/src/parseTarball.ts checks only for forward-slash traversal patterns (./), but fails to check for backslash patterns (\) used as directory separators on Windows. An attacker can craft a malicious tarball with entries like "package/foo\..\..\.npmrc" that bypass the check and allow writing to parent directories. The flaw requires user interaction (running pnpm install) and network access to host or reference the malicious tarball, but does not require authentication. An attacker can overwrite .npmrc, configuration files, or other executables. The vulnerability is fixed in pnpm version 10.28.1 and later.
Affected products
- pnpm pnpm <=10.28.0
Timeline
- 2026-01-26: disclosed
- 2026-01-26: patched: fixed in version 10.28.1