CVE-2026-23889: pnpm Windows-Specific Tarball Path Traversal Vulnerability
Summary
CVE-2026-23889: pnpm has Windows-specific tarball Path Traversal. Affects pnpm versions < 10.28.1. Fixed in 10.28.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pnpm is a fast, disk space-efficient package manager for JavaScript and Node.js applications. It allows developers to manage project dependencies effectively, utilizing a unique symlink structure to optimize storage. However, pnpm is vulnerable to a path traversal issue on Windows systems, which can lead to unauthorized file access.
Vulnerability Detail
A path traversal vulnerability exists in pnpm's tarball extraction process, specifically affecting Windows users. The issue arises from incomplete path normalization, where the code only checks for forward slashes (./) but not for backslashes (), which are used as directory separators in Windows. This oversight allows malicious packages to write files outside the intended package directory, potentially overwriting critical configuration files like .npmrc. The vulnerability is particularly concerning for Windows CI/CD pipelines, as it can lead to unauthorized access and manipulation of sensitive files.
How To Fix
Minimum fixed version
10.28.1
This is the first release that contains the fix.
npm install pnpm@10.28.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid installing untrusted or unknown tarballs until you can update pnpm. Additionally, you can manually inspect tarballs for suspicious file paths before installation.
Conclusion
The pnpm vulnerability CVE-2026-23889 poses a significant risk to Windows users by allowing path traversal through malicious tarballs. It is crucial to update to the patched version 10.28.1 or later to mitigate this risk. Users should also consider using tools like Vulert for ongoing monitoring of vulnerabilities in their applications.
See every vulnerability recorded for pnpm →
FAQ
The vulnerability is a path traversal issue that allows malicious packages to write files outside the package directory on Windows systems.
Windows users of pnpm, including those using CI/CD pipelines like GitHub Actions and Azure DevOps, are affected.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application using the Vulert playground at Vulert Scanner.
The CVSS score for this vulnerability is 6.5, indicating a moderate level of risk.
If you cannot update pnpm right away, avoid installing untrusted tarballs and inspect any tarballs for suspicious paths before installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for pnpm.
