CVE-2026-24131: 
JavaScript vulnerability analysis and mitigation

CVE-2026-24131 is a path traversal vulnerability in pnpm (a Node.js package manager) that allows a malicious npm package to cause pnpm to apply chmod 755 to files at arbitrary locations outside the intended package directory. It affects all pnpm versions prior to 10.28.2 and was disclosed on January 26, 2026. The vulnerability is exclusive to Unix/Linux/macOS systems; Windows is not affected. It carries a CVSS v3.1 base score of 5.5 (Medium) and a CVSS v4.0 base score of 6.7 (Medium) (GitHub Advisory, pnpm Security Advisory).

The root cause is an improper path validation (CWE-22: Path Traversal; CWE-732: Incorrect Permission Assignment for Critical Resource) in pkg-manager/package-bins/src/index.ts. When pnpm processes a package's directories.bin field, it constructs the binary directory path using path.join(pkgPath, manifest.directories.bin) without subsequently verifying that the resolved path remains within the package root via isSubdir(). Notably, the bin field in package.json is already protected by isSubdir() at line 53, but directories.bin lacked this check. A malicious package can specify "directories": {"bin": "../../../../tmp/target"} in its package.json, causing pnpm to enumerate and chmod 755 all non-dotfiles in the traversed directory during installation (pnpm Security Advisory, Patch Commit).

Successful exploitation enables a supply-chain attacker to change file permissions of sensitive files (e.g., private keys, scripts, configuration files) to world-readable/executable (755), directly compromising confidentiality by exposing previously restricted content. Files in predictable paths that are not dotfiles are at risk; for example, a file previously set to 600 (owner-read-only) becomes readable by all users on the system. While integrity and availability impacts are not directly scored, the permission change could facilitate privilege escalation or execution of unintended code if executable scripts are affected (GitHub Advisory, pnpm Security Advisory).

A proof-of-concept (PoC) is publicly available in the GitHub security advisory, demonstrating the full attack chain from crafting a malicious package to observing the permission change. There is no evidence of active in-the-wild exploitation as of the disclosure date. The EPSS score is approximately 0.017% (1st percentile), indicating low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported (GitHub Advisory, Feedly).

1. Craft a malicious npm package: Create a directory (e.g., /tmp/malicious-pkg) and write a package.json with a path-traversal payload in the directories.bin field:

{"name":"malicious","version":"1.0.0","directories":{"bin":"../../../../tmp/target"}}

2. Identify a target path: Choose a predictable directory containing sensitive non-dotfiles (e.g., /tmp/target/secret.sh with permissions 600).
3. Publish or distribute the package: Host the malicious package on a registry or distribute it as a local/file dependency to a victim who uses pnpm on Unix/Linux/macOS.
4. Trigger installation: When the victim runs pnpm add file:/tmp/malicious-pkg (or installs the package from a registry), pnpm processes the directories.bin field without path validation.
5. Observe permission change: pnpm enumerates files in the traversed directory and applies chmod 755, making previously private files world-readable (e.g., ls -la /tmp/target/secret.sh now shows -rwxr-xr-x).
6. Read sensitive data: The attacker (or any local user) can now read the exposed file contents, potentially accessing credentials, private keys, or other sensitive data (pnpm Security Advisory).

• File System: Files outside the installed package directory with unexpectedly changed permissions (e.g., previously 600 files now showing 755); presence of a package.json with a directories.bin value containing ../ sequences in installed packages.
• Logs: pnpm installation logs referencing chmod or fixBin operations on paths outside the node_modules package subdirectory; audit logs showing permission changes on sensitive files (e.g., SSH keys, scripts) coinciding with a pnpm add or pnpm install invocation.
• Process: Unexpected chmod system calls originating from the pnpm Node.js process targeting directories outside the project's node_modules tree (detectable via strace, auditd, or similar tools on Linux/macOS).

Upgrade pnpm to version 10.28.2 or later, which adds isSubdir() validation for the directories.bin field, rejecting any path that resolves outside the package root (pnpm Release, Patch Commit). IBM API Connect users should consult the IBM advisories for product-specific patching guidance (IBM Advisory). As an interim measure if patching is not immediately possible, restrict pnpm usage to trusted, verified package sources and audit installed packages for suspicious directories.bin values containing path traversal sequences.

The vulnerability was reported by security researcher mldangelo and patched promptly by pnpm maintainer Zoltan Kochan (zkochan) on the same day as disclosure (January 26, 2026). Red Hat tracked the issue via Bugzilla (Bug 2433115) and IBM issued advisories for affected API Connect products. No significant broader media coverage or notable social media discussion has been identified beyond standard vulnerability database entries (Red Hat Bugzilla, IBM Advisory).