CVE-2026-23889CWE-22

pnpm has Windows-specific tarball Path Traversal

Medium · published January 26, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
40.7
In the wild
Unconfirmed
What it is

pnpm is a package manager. Prior to version 10.28.1, a path traversal vulnerability in pnpm's tarball extraction allows malicious packages to write files outside the package directory on Windows. The path normalization only checks for `./` but not `.\`. On Windows, backslashes are directory separators, enabling path traversal. This vulnerability is Windows-only. This issue impacts Windows pnpm users and Windows CI/CD pipelines (GitHub Actions Windows runners, Azure DevOps). It can lead to overwriting `.npmrc`, build configs, or other files. Version 10.28.1 contains a patch.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00483 · 40.7th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-01-26T21:50Z
EPSS history
Timeline
  • 26 JAN 21:50Z
    pnpm has Windows-specific tarball Path Traversal
    cvelistv5