CVE-2026-23890: 
JavaScript vulnerability analysis and mitigation

CVE-2026-23890 is a relative path traversal vulnerability in pnpm's bin linking functionality that allows malicious npm packages to create executable shims or symlinks outside of node_modules/.bin. It affects all pnpm versions prior to 10.28.1 for Node.js. The vulnerability was discovered by researcher mldangelo, published on January 26, 2026, and patched the same day. It carries a CVSS v3.1 base score of 6.5 (Medium) (Github Advisory, pnpm Security Advisory).

The root cause is a two-stage flaw classified as CWE-23 (Relative Path Traversal) in pnpm's bin name validation and normalization logic within pkg-manager/package-bins/src/index.ts. First, the validation filter allows any bin name starting with @ to bypass URI-encoding checks entirely. Second, the normalizeBinName() function strips only the scope prefix (everything up to and including /), leaving path traversal sequences like ../../ intact — for example, input @scope/../../evil yields ../../evil. The resulting normalized name is then passed directly to path.join() in pkg-manager/link-bins/src/index.ts without further sanitization, enabling writes to arbitrary filesystem locations. A proof-of-concept is publicly available in the security advisory (pnpm Security Advisory, pnpm Commit).

Exploitation allows a malicious npm package to create or overwrite arbitrary files on the filesystem wherever the installing user has write permissions, including configuration files (e.g., .npmrc), shell scripts, CI/CD pipeline scripts, and other sensitive files. This can lead to code execution if overwritten scripts or configs are subsequently invoked by the build system or developer tooling. All pnpm users who install npm packages are affected, with particular risk to automated CI/CD pipelines where package installation is routine and file overwrites may go undetected (Github Advisory, Red Hat Bugzilla).

A proof-of-concept exploit is publicly documented in the pnpm security advisory, demonstrating creation of files outside node_modules/.bin by crafting a malicious package.json with a scoped bin name containing path traversal sequences. Exploitation requires user interaction — specifically, a developer or CI system must run pnpm add or equivalent to install the malicious package. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.032% (0.000320), indicating low near-term exploitation probability (Github Advisory, pnpm Security Advisory).

1. Craft a malicious package: Create a local or registry-hosted npm package with a package.json that uses a scoped bin name containing path traversal sequences, e.g.:

{
  "name": "malicious-pkg",
  "version": "1.0.0",
  "bin": {
    "@scope/../../.npmrc": "./malicious.js"
  }
}

2. Publish or distribute the package: Upload the package to a public or private npm registry, or distribute it as a local tarball/path for targeted attacks (e.g., via dependency confusion or typosquatting).
3. Trigger installation: Wait for or socially engineer a victim to run pnpm add malicious-pkg (or include it as a dependency in a project). In CI/CD environments, this may happen automatically on pipeline runs.
4. Path traversal executes: During bin linking, pnpm normalizes @scope/../../.npmrc to ../../.npmrc and passes it to path.join(), causing the file malicious.js to be written as .npmrc in the project root (or another targeted location outside node_modules/.bin).
5. Achieve persistence or code execution: The overwritten file (e.g., .npmrc, a shell script, or a CI configuration file) is subsequently executed by the developer's toolchain or CI system, enabling arbitrary command execution (pnpm Security Advisory).

• File System: Unexpected files appearing in the project root or parent directories (e.g., .npmrc, shell scripts, CI config files) immediately after running pnpm add or pnpm install; new or modified executable files outside node_modules/.bin with timestamps matching a recent package installation.
• Logs: pnpm installation logs referencing bin names containing @scope/ followed by ../ sequences; unexpected file creation events in directories above node_modules/ captured by file integrity monitoring tools.
• Process: Unexpected script execution originating from files in the project root or parent directories shortly after a pnpm install operation; CI/CD pipeline steps invoking scripts that were not previously present.
• Network: Outbound connections from CI/CD agents to unknown hosts following a package installation step, potentially indicating execution of a dropped payload (pnpm Security Advisory).

Upgrade pnpm to version 10.28.1 or later, which fixes the vulnerability by validating the normalized bin name against URI-safe characters after scope stripping and rejecting any name that fails this check (pnpm Release, pnpm Commit). No configuration-based workaround is available for unpatched versions. As additional hardening measures, audit recently installed packages for suspicious scoped bin entries, verify the integrity of configuration files and scripts after any package installation, and implement package scanning in CI/CD pipelines before installation. IBM API Connect users should consult IBM's advisories for product-specific patch guidance (IBM Advisory 1, IBM Advisory 2).

The vulnerability was reported by researcher mldangelo and published by pnpm maintainer zkochan on January 26, 2026, with a patch released the same day. Red Hat tracked the issue via Bugzilla (Bug 2433090) and assigned it medium priority, noting its potential for arbitrary code execution via path traversal in bin linking (Red Hat Bugzilla). IBM subsequently issued advisories for affected IBM API Connect products (IBM Advisory 1). Community reaction on the pnpm GitHub release was positive, with 18 users reacting to the v10.28.1 release notes (pnpm Release).