VDB
CVE-2026-23889
CVE-2026-23889
PUBLISHED
CVSS 6.5 MEDIUM
pnpm is a package manager. Prior to version 10.28.1, a path traversal vulnerability in pnpm's tarball extraction allows malicious packages to write files outside the package directory on Windows. The path normalization only checks for `./` but not `.\`. On Windows, backslashes are directory separators, enabling path traversal. This vulnerability is Windows-only. This issue impacts Windows pnpm users and Windows CI/CD pipelines (GitHub Actions Windows runners, Azure DevOps). It can lead to overwriting `.npmrc`, build configs, or other files. Version 10.28.1 contains a patch.
EPSS 0.48% · 41.4th percentile
Risk Scores
CVSS 3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
EPSS Score
0.48%
41.4th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| pnpm | pnpm | < 10.28.1, 0 |
| npm | pnpm | 0, 0, 0 |
Timeline
- Jan 26, 2026 CVE Published
- Jan 27, 2026 EPSS Score
- Jan 27, 2026 PoC Published
- Jan 29, 2026 CVE Updated
- Jan 30, 2026 EPSS Score
- Jan 30, 2026 Security Advisory
- Feb 3, 2026 EPSS Score
- Feb 6, 2026 EPSS Score
- Feb 10, 2026 EPSS Score
- Feb 13, 2026 EPSS Score
- Feb 16, 2026 EPSS Score
- Feb 20, 2026 EPSS Score