CVE-2026-23890: pnpm Path Traversal Vulnerability Allows Arbitrary File Creation
Summary
CVE-2026-23890: pnpm scoped bin name Path Traversal allows arbitrary file creation outside node_modules/.bin. Affects pnpm versions < 10.28.1. Fixed in 10.28.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
pnpm is a fast, disk space-efficient package manager for JavaScript and Node.js applications. It is designed to manage project dependencies efficiently by using a content-addressable filesystem. However, a recent vulnerability has been identified that allows malicious npm packages to create executable files outside the intended directory structure, potentially compromising the security of applications that rely on pnpm.
Vulnerability Detail
A path traversal vulnerability in pnpm's bin linking mechanism allows malicious npm packages to create executable shims or symlinks outside of the 'node_modules/.bin' directory. This issue arises from inadequate validation of bin names that start with '@', which bypasses necessary checks. The normalization process fails to sanitize path traversal sequences, allowing attackers to exploit this flaw by crafting malicious package names that can lead to the creation of files in unintended locations, such as the project root. This could result in overwriting sensitive configuration files or scripts, posing a significant risk to all users of pnpm, including those in CI/CD pipelines.
How To Fix
Latest published version: 12.15.0 as of 23 Oct 2026
npm install pnpm@12.15.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
10.28.1
This is the first release that contains the fix.
npm install pnpm@10.28.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid installing packages that use bin names starting with '@' until you can update pnpm to the patched version. Additionally, you can manually inspect and validate the bin names of packages before installation.
Conclusion
The pnpm path traversal vulnerability (CVE-2026-23890) poses a significant risk to users by allowing malicious packages to create files outside the intended directory structure. It is crucial to update to the patched version (10.28.1) to mitigate this risk and ensure the security of your applications.
See every vulnerability recorded for pnpm →
FAQ
The vulnerability allows malicious npm packages to create files outside of the intended directory structure due to inadequate validation of bin names.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By checking your package-lock.json file, you can determine if your application is affected by this vulnerability.
The vulnerability can lead to the overwriting of sensitive files, such as configuration files and scripts, which can compromise the security of your application.
Yes, you can avoid installing packages with bin names starting with '@' and manually validate any packages before installation.
The CVSS score of this vulnerability is 6.5, indicating a moderate level of risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for pnpm.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
