Homepage

Directory Traversal Affecting pnpm package, versions <10.28.1-r0

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.49% (41st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-MINIMOSLATEST-PNPM-15147461
  • published30 Jan 2026
  • disclosed26 Jan 2026
Report a new vulnerability Found a mistake?

Introduced: 26 Jan 2026

CVE-2026-23889  (opens in a new tab)
CWE-22  (opens in a new tab)

How to fix?

Upgrade Minimos:latest pnpm to version 10.28.1-r0 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream pnpm package and not the pnpm package as distributed by Minimos. See How to fix? for Minimos:latest relevant fixed versions and status.

pnpm is a package manager. Prior to version 10.28.1, a path traversal vulnerability in pnpm's tarball extraction allows malicious packages to write files outside the package directory on Windows. The path normalization only checks for ./ but not .\. On Windows, backslashes are directory separators, enabling path traversal. This vulnerability is Windows-only. This issue impacts Windows pnpm users and Windows CI/CD pipelines (GitHub Actions Windows runners, Azure DevOps). It can lead to overwriting .npmrc, build configs, or other files. Version 10.28.1 contains a patch.