pnpm is a package manager. Prior to version 10.28.1, a path traversal vulnerability in pnpm's tarball extraction allows malicious packages to write files outside the package directory on Windows. The path normalization only checks for `./` but not `.\`. On Windows, backslashes are directory separators, enabling path traversal. This vulnerability is Windows-only. This issue impacts Windows pnpm users and Windows CI/CD pipelines (GitHub Actions Windows runners, Azure DevOps). It can lead to overwriting `.npmrc`, build configs, or other files. Version 10.28.1 contains a patch.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
References
History
Mon, 26 Jan 2026 22:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | pnpm is a package manager. Prior to version 10.28.1, a path traversal vulnerability in pnpm's tarball extraction allows malicious packages to write files outside the package directory on Windows. The path normalization only checks for `./` but not `.\`. On Windows, backslashes are directory separators, enabling path traversal. This vulnerability is Windows-only. This issue impacts Windows pnpm users, Windows CI/CD pipelines (GitHub Actions Windows runners, Azure DevOps), and those who can overwrite `.npmrc`, build configs, or other files. Version 10.28.1 contains a patch. | pnpm is a package manager. Prior to version 10.28.1, a path traversal vulnerability in pnpm's tarball extraction allows malicious packages to write files outside the package directory on Windows. The path normalization only checks for `./` but not `.\`. On Windows, backslashes are directory separators, enabling path traversal. This vulnerability is Windows-only. This issue impacts Windows pnpm users and Windows CI/CD pipelines (GitHub Actions Windows runners, Azure DevOps). It can lead to overwriting `.npmrc`, build configs, or other files. Version 10.28.1 contains a patch. |
Mon, 26 Jan 2026 22:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | pnpm is a package manager. Prior to version 10.28.1, a path traversal vulnerability in pnpm's tarball extraction allows malicious packages to write files outside the package directory on Windows. The path normalization only checks for `./` but not `.\`. On Windows, backslashes are directory separators, enabling path traversal. This vulnerability is Windows-only. This issue impacts Windows pnpm users, Windows CI/CD pipelines (GitHub Actions Windows runners, Azure DevOps), and those who can overwrite `.npmrc`, build configs, or other files. Version 10.28.1 contains a patch. | |
| Title | pnpm has Windows-specific tarball Path Traversal | |
| Weaknesses | CWE-22 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-01-26T22:00:18.657Z
Reserved: 2026-01-16T21:02:02.902Z
Link: CVE-2026-23889
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-01-26T22:15:56.213
Modified: 2026-01-26T22:15:56.213
Link: CVE-2026-23889
Redhat
No data.
OpenCVE Enrichment
No data.