CVE-2026-23890CWE-23

pnpm scoped bin name Path Traversal allows arbitrary file creation outside node_modules/.bin

Medium · published January 26, 2026

CVSS v3.1
6.5
EPSS
1%
Percentile
42.1
In the wild
Unconfirmed
What it is

pnpm is a package manager. Prior to version 10.28.1, a path traversal vulnerability in pnpm's bin linking allows malicious npm packages to create executable shims or symlinks outside of `node_modules/.bin`. Bin names starting with `@` bypass validation, and after scope normalization, path traversal sequences like `../../` remain intact. This issue affects all pnpm users who install npm packages and CI/CD pipelines using pnpm. It can lead to overwriting config files, scripts, or other sensitive files. Version 10.28.1 contains a patch.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00502 · 42.1th percentile
Weakness
CWE-23 · Relative Path Traversal
Published
2026-01-26T21:53Z
EPSS history
Timeline
  • 26 JAN 21:53Z
    pnpm scoped bin name Path Traversal allows arbitrary file creation outside node_modules/.bin
    cvelistv5