CVE-2026-23890: pnpm scoped bin name path traversal

CVE-2026-23890 · Severity: low · CVSS 3.1 · Published 2026-01-26

pnpm is a package manager used to install and manage dependencies for Node.js projects. A path traversal vulnerability in its bin linking mechanism allows malicious npm packages to create or overwrite files outside the intended node_modules/.bin directory, potentially enabling attackers to modify configuration files, scripts, or other sensitive files on a developer's system or in CI/CD pipelines.

Technologies: pnpm (npm). Vendors: npm.

Quick answers

Is CVE-2026-23890 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-23890 being exploited in the wild.
How severe is CVE-2026-23890?
Low severity, with a CVSS score of 3.1, published 26 January 2026.
Which products and versions are affected?
pnpm (npm) SEMVER:introduced=0,fixed=10.28.1.
Is there a fix for CVE-2026-23890?
Yes. pnpm (npm): upgrade to 10.28.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-23890 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-23890?
Check whether you run pnpm (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • pnpm (npm): upgrade to 10.28.1 or later
    npm install pnpm@10.28.1

Technical details

The vulnerability is a path traversal (CWE-22) in pnpm's bin name validation and normalization logic. Bin names starting with "@" bypass the validation filter, and the normalizeBinName function incompletely strips the scope prefix, preserving path traversal sequences like "../../" in the resulting name. When the normalized name is used directly in path.join() without further validation, an attacker can craft a malicious npm package with a bin entry like "@scope/../../.npmrc" that, after normalization, becomes "../../.npmrc", allowing file creation outside node_modules/.bin. The attack requires a user to install the malicious package, but no authentication or special privileges are required. The vulnerability affects all pnpm versions up to 10.28.0; version 10.28.1 and later contain fixes.

Affected products

  • pnpm pnpm <= 10.28.0

Identifiers

  • CVE-2026-23890
  • GHSA-xpqm-wm3m-f34h

Timeline

  • 2026-01-26: disclosed
  • 2026-01-26: patched: pnpm version 10.28.1 released with fix

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.