6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-23890

CVE-2026-23890: pnpm scoped bin name Path Traversal allows arbitrary file creation outside node_modules/.bin

pnpm is a package manager. Prior to version 10.28.1, a path traversal vulnerability in pnpm's bin linking allows malicious npm packages to create executable shims or symlinks outside of node_modules/.bin. Bin names starting with @ bypass validation, and after scope normalization, path traversal sequences like ../../ remain intact. This issue affects all pnpm users who install npm packages and CI/CD pipelines using pnpm. It can lead to overwriting config files, scripts, or other sensitive files. Version 10.28.1 contains a patch.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-23890

CVE-2026-23890:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pnpm	npm	< 10.28.1	10.28.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a path traversal issue in pnpm's handling of the 'bin' field in a package.json file. The root cause lies in two functions within 'pkg-manager/package-bins/src/index.ts': 'commandsFromBin' and 'normalizeBinName'.

The 'commandsFromBin' function was responsible for processing the bin entries. Its filtering logic explicitly allowed any bin name starting with an '@' symbol to bypass URI-component encoding validation. This was the entry point for the vulnerability.

This unfiltered input was then passed to the 'normalizeBinName' function. This function would strip the npm scope from the bin name (e.g., '@scope/'), but it failed to remove any path traversal sequences that followed. For example, an input of '@scope/../../evil' would result in an output of '../../evil'.

This malicious, normalized path was then used to create a symlink or shim in the 'node_modules/.bin' directory, allowing an attacker to write files to arbitrary locations on the filesystem relative to the project root, leading to potential remote code execution or configuration file overwrites.

The patch addresses this by completely rewriting the 'commandsFromBin' function. The new implementation performs validation after normalizing the bin name, ensuring that any path traversal sequences are detected and rejected. The separate 'normalizeBinName' function was removed entirely, and its logic was integrated into the new, more secure 'commandsFromBin' function.

Vulnerable functions

commandsFromBin

pkg-manager/package-bins/src/index.ts

This function processes the 'bin' field from a package's manifest. The original implementation had a filter that allowed bin names starting with '@' to bypass validation. It then used the vulnerable 'normalizeBinName' function, which could return a string containing path traversal characters. This allows a malicious package to create files outside the 'node_modules/.bin' directory.

normalizeBinName

pkg-manager/package-bins/src/index.ts

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.