CVE-2026-23889
Description
pnpm is a package manager. Prior to version 10.28.1, a path traversal vulnerability in pnpm's tarball extraction allows malicious packages to write files outside the package directory on Windows. The path normalization only checks for `./` but not `.\`. On Windows, backslashes are directory separators, enabling path traversal. This vulnerability is Windows-only. This issue impacts Windows pnpm users and Windows CI/CD pipelines (GitHub Actions Windows runners, Azure DevOps). It can lead to overwriting `.npmrc`, build configs, or other files. Version 10.28.1 contains a patch.
How to fix
- pnpm pnpm10.28.1 or later
- pnpm10.28.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pnpm pnpm | v < 10.28.1 | 10.28.1 |
| pnpmnpm | v < 10.28.1 | 10.28.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.