CVE Feed

    Dashboard / CVE / CVE-2026-24131

    CVE-2026-24131

    pnpm is a package manager. Prior to version 10.28.2, when pnpm processes a package's `directories.bin` field, it uses `path.join()` without validating the result stays within the package root. A malicious npm package can specify `"directories": {"bin": "../../../../tmp"}` to escape the package directory, causing pnpm to chmod 755 files at arbitrary locations. This issue only affects Unix/Linux/macOS. Windows is not affected (`fixBin` gated by `EXECUTABLE_SHEBANG_SUPPORTED`). Version 10.28.2 contains a patch.

    Published:Jan 26, 2026
    Last Modified:Apr 18, 2026
    EPS:Jan 26, 2026
    EPSS Score:0.00007
    CVSS Score:5.5

    Affected Products

    Vendor
    Pnpm
    Product
    Pnpm

    Exploits

    https://github.com/pnpm/pnpm/security/advisories/GHSA-v253-rj99-jwpq

    Related CVEs

    CVE-2026-82393 (CVSS 7.5) — pnpm is a package manager. Prior to 10.34.5 and 11.11.0, pnpm accepts a scoped path traversal in a tarball dep…
    CVE-2026-82392 (CVSS 7.1) — pnpm is a package manager. Prior to 10.34.5 and from 11.0.0 until 11.11.0, pnpm parses the package name from a…
    CVE-2026-59195 (CVSS 8.2) — pnpm is a package manager. Prior to 10.34.4 and 11.8.0, pnpm accepts package names from the env lockfile confi…
    CVE-2026-59196 (CVSS 7.1) — pnpm is a package manager. Prior to 10.34.4 and 11.7.0, a crafted lockfile alias could be joined directly unde…
    CVE-2026-59194 (CVSS 7.1) — pnpm is a package manager. Prior to 10.34.4 and 11.7.0, a crafted patch entry could resolve outside the config…
    CVE-2026-55180 (CVSS 6.5) — pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm and pacquet expanded ${ENV_VAR} placeholders from…
    CVE-2026-48995 (CVSS 4.8) — pnpm is a package manager. Prior to 10.33.4 and 11.0.7, a malicious codeload.github.com server can serve whate…
    CVE-2026-50017 (CVSS 6.9) — pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm can send user-level unscoped npm authentication c…
    CVE-2026-50016 (CVSS 8.8) — pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm allows a transitive dependency alias from registr…
    CVE-2026-50015 (CVSS 7.3) — pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm's patch application pipeline (@pnpm/patch-package…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High