CVE-2026-23889: 
JavaScript vulnerability analysis and mitigation

CVE-2026-23889 is a Windows-specific path traversal vulnerability in pnpm's tarball extraction that allows malicious packages to write files outside the intended package directory. It affects all pnpm versions prior to 10.28.1 for Node.js on Windows. The vulnerability was published on January 26, 2026, by GitHub Security (GHSA-6x96-7vc8-cm3p) and assigned a CVSS v3.1 base score of 6.5 (Medium) (Github Advisory, pnpm Advisory).

The root cause is an incomplete path normalization check (CWE-22) in store/cafs/src/parseTarball.ts. The existing guard only checks for ./ in tarball entry filenames but not for .\, meaning a crafted path like package/foo\..\..\.npmrc bypasses the check entirely. On Windows, backslashes are valid directory separators, so when pnpm extracts such a tarball entry, the path resolves outside the package directory. The fix in commit 6ca07ff extends the check to also detect .\ and normalizes backslashes to forward slashes before applying POSIX path resolution (pnpm Advisory, pnpm Commit). A public proof-of-concept Python script was included in the advisory, demonstrating creation of a malicious .tgz with a traversal entry.

Successful exploitation allows an attacker to overwrite arbitrary files accessible to the user running pnpm install, with no impact on confidentiality or availability but a high integrity impact. Targeted files could include .npmrc (enabling registry redirection to an attacker-controlled server), build configuration files, CI/CD pipeline scripts, or other sensitive project files. The attack is particularly dangerous in Windows-based CI/CD environments such as GitHub Actions Windows runners and Azure DevOps, where a compromised build configuration could enable supply chain attacks affecting downstream consumers (Github Advisory, pnpm Advisory).

A public proof-of-concept is included in the official security advisory, demonstrating how to craft a malicious tarball using Python. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.02% (6th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — specifically, a developer or CI pipeline must install the malicious package (Github Advisory, pnpm Advisory).

1. Craft a malicious tarball: Using Python's tarfile module, create a .tgz package containing a valid package/package.json and a malicious entry with a backslash-traversal path such as package/foo\..\..\.npmrc. Set the malicious file's content to redirect the npm registry (e.g., registry=https://evil.com/).
2. Distribute the malicious package: Publish the crafted package to a public or private npm registry, or host the .tgz directly and reference it as a tarball URL dependency in a target project's package.json.
3. Trigger installation on a Windows target: Wait for or socially engineer a Windows user or CI/CD pipeline (e.g., GitHub Actions Windows runner, Azure DevOps) to run pnpm install in a project that depends on the malicious package.
4. Achieve arbitrary file write: During tarball extraction, pnpm on Windows resolves the backslash path traversal, writing the attacker-controlled content (e.g., a rogue .npmrc) outside the package directory — potentially into the project root or user home directory.
5. Leverage the written file: If .npmrc is overwritten, subsequent pnpm install or npm install commands in the same environment will resolve packages from the attacker's registry, enabling further supply chain compromise or credential harvesting (pnpm Advisory).

• File System: Unexpected or modified .npmrc file in the project root or user home directory (%USERPROFILE%\.npmrc) with unfamiliar registry URLs; unexpected files written outside node_modules directories after a pnpm install run; new or modified build configuration files (e.g., .babelrc, webpack.config.js) not matching version control.
• Network: Outbound HTTP/HTTPS requests to unknown or suspicious npm registry domains during or after package installation; DNS queries for unfamiliar registry hostnames from CI/CD build agents.
• Logs: pnpm install logs referencing packages with unusual tarball URLs (direct .tgz links from untrusted domains); CI/CD pipeline logs showing file writes outside expected node_modules paths on Windows runners.
• Process: Unexpected processes spawned after pnpm install on Windows, particularly if a compromised build script is executed as a result of an overwritten config file (pnpm Advisory).

Upgrade pnpm to version 10.28.1 or later, which contains the patch normalizing backslash path traversal in tarball extraction (pnpm Release). For Windows CI/CD pipelines using GitHub Actions or Azure DevOps, ensure the pnpm version is pinned to 10.28.1 or above in pipeline configuration. As a supply chain hygiene measure, restrict package installation to trusted, vetted registries and audit package.json dependencies for direct tarball URL references from unknown sources. IBM API Connect users should consult the IBM advisory for product-specific patch guidance (IBM Advisory).

The vulnerability was reported by security researcher mldangelo and published by pnpm maintainer zkochan on January 26, 2026. Red Hat tracked the issue via Bugzilla (Bug 2433093) with medium priority, and IBM subsequently issued advisories for affected IBM API Connect versions in May 2026 (Red Hat Bugzilla, IBM Advisory). Community reaction was generally measured given the Windows-only scope and the requirement for user interaction, with no significant controversy or widespread alarm noted.