GHSA-v253-rj99-jwpq

Опубликовано: 26 янв. 2026

Источник: github

Github: Прошло ревью

CVSS4: 6.7

Описание

pnpm has Path Traversal via arbitrary file permission modification

Summary

When pnpm processes a package's directories.bin field, it uses path.join() without validating the result stays within the package root. A malicious npm package can specify "directories": {"bin": "../../../../tmp"} to escape the package directory, causing pnpm to chmod 755 files at arbitrary locations.

Note: Only affects Unix/Linux/macOS. Windows is not affected (fixBin gated by EXECUTABLE_SHEBANG_SUPPORTED).

Details

Vulnerable code in pkg-manager/package-bins/src/index.ts:15-21:

if (manifest.directories?.bin) { const binDir = path.join(pkgPath, manifest.directories.bin) // NO VALIDATION const files = await findFiles(binDir) // ... files outside package returned, then chmod 755'd }

The bin field IS protected with isSubdir() at line 53, but directories.bin lacks this check.

PoC

# Create malicious package mkdir /tmp/malicious-pkg echo '{"name":"malicious","version":"1.0.0","directories":{"bin":"../../../../tmp/target"}}' > /tmp/malicious-pkg/package.json # Create sensitive file mkdir -p /tmp/target echo "secret" > /tmp/target/secret.sh chmod 600 /tmp/target/secret.sh # Private # Install pnpm add file:/tmp/malicious-pkg # Check permissions ls -la /tmp/target/secret.sh # Now 755 (world-readable)

Impact

Supply-chain attack via npm packages
File permissions changed from 600 to 755 (world-readable)
Affects non-dotfiles in predictable paths (dotfiles excluded by tinyglobby default)

Suggested Fix

Add isSubdir validation for directories.bin paths in pkg-manager/package-bins/src/index.ts, matching the existing validation in commandsFromBin():

if (manifest.directories?.bin) { const binDir = path.join(pkgPath, manifest.directories.bin) if (!isSubdir(pkgPath, binDir)) { return [] // Reject paths outside package } // ... }

Ссылки

Пакеты

Наименование

pnpm

npm

Затронутые версииВерсия исправления

< 10.28.2

10.28.2

EPSS

Процентиль: 2%

0.00015

Низкий

6.7 Medium

CVSS4

CVE ID

CVE-2026-24131

Дефекты

CWE-22

CWE-732

Связанные уязвимости

CVE-2026-24131

CVSS3: 5.5

nvd

8 дней назад

pnpm is a package manager. Prior to version 10.28.2, when pnpm processes a package's `directories.bin` field, it uses `path.join()` without validating the result stays within the package root. A malicious npm package can specify `"directories": {"bin": "../../../../tmp"}` to escape the package directory, causing pnpm to chmod 755 files at arbitrary locations. This issue only affects Unix/Linux/macOS. Windows is not affected (`fixBin` gated by `EXECUTABLE_SHEBANG_SUPPORTED`). Version 10.28.2 contains a patch.

CVE-2026-24131

CVSS3: 5.5

debian

8 дней назад

pnpm is a package manager. Prior to version 10.28.2, when pnpm process ...

BDU:2026-01028

CVSS3: 5.5

fstec

14 дней назад

Уязвимость функции path.join() менеджера пакетов pnpm, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации и повысить свои привилегии

EPSS

Процентиль: 2%

0.00015

Низкий

6.7 Medium

CVSS4

CVE ID

CVE-2026-24131

Дефекты

CWE-22

CWE-732