CVE-2026-23888: pnpm Binary ZIP Extraction Path Traversal Vulnerability
Summary
CVE-2026-23888: pnpm: Binary ZIP extraction allows arbitrary file write via path traversal (Zip Slip). Affects pnpm versions < 11.0.0-alpha.3. Fixed in 11.0.0-alpha.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pnpm is a fast, disk space-efficient package manager for JavaScript and Node.js applications. It allows users to manage dependencies and install packages efficiently. However, pnpm has a vulnerability in its binary fetching mechanism that can be exploited to write files outside the intended extraction directory, posing a significant security risk.
Vulnerability Detail
The vulnerability arises from a path traversal issue in pnpm's binary fetcher, specifically in the way ZIP files are extracted. Malicious ZIP entries can contain paths that escape the intended extraction directory, allowing attackers to write files to arbitrary locations on the filesystem. This can lead to overwriting sensitive configuration files or executing malicious scripts, potentially resulting in remote code execution (RCE). The vulnerability has two main attack vectors: unvalidated ZIP entry extraction and unvalidated prefix in the BinaryResolution field.
How To Fix
Latest published version: 12.15.0 as of 23 Oct 2026
npm install pnpm@12.15.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
11.0.0-alpha.3
This is the first release that contains the fix.
npm install pnpm@11.0.0-alpha.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid installing packages that contain binary assets from untrusted sources. Additionally, you can manually inspect ZIP files before extraction to ensure they do not contain malicious entries.
Conclusion
CVE-2026-23888 is a significant vulnerability in pnpm that allows for path traversal during ZIP extraction, potentially leading to severe security issues. It is crucial for users to update to the patched version and implement best practices to mitigate risks associated with this vulnerability.
See every vulnerability recorded for pnpm →
FAQ
CVE-2026-23888 is a vulnerability in pnpm that allows arbitrary file writes via path traversal during ZIP extraction.
If your application uses pnpm to manage packages with binary assets, an attacker could exploit this vulnerability to overwrite sensitive files or execute malicious code.
All versions of pnpm prior to 11.0.0-alpha.3 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your package-lock.json file with Vulert to see if your application is affected by this vulnerability.
If you cannot update pnpm right away, avoid installing untrusted packages and inspect ZIP files manually before extraction as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for pnpm.
