pnpm has Path Traversal via arbitrary file permission modification (CVE-2026-24131)

pnpm, a package manager, improperly validates the directories.bin field in package manifests prior to version 10.28.2. It uses path.join() without ensuring the resolved path remains within the package root directory. A malicious npm package can exploit this by specifying a bin directory path that traverses outside the package root (e.g., "../../../../tmp"), leading pnpm to modify file permissions (chmod 755) on arbitrary files outside the intended directory. This vulnerability affects Unix, Linux, and macOS platforms but not Windows, due to platform-specific gating of the fixBin functionality. The vulnerability is addressed in pnpm version 10.28.2.

An attacker publishing a malicious npm package can cause pnpm to change file permissions on arbitrary files outside the package directory on Unix-like systems. This could lead to unauthorized modification of file permissions, potentially enabling further exploitation or disruption of system files. Windows systems are not affected. There are no known exploits in the wild at this time.

Users should upgrade pnpm to version 10.28.2 or later, where this path traversal and arbitrary permission modification vulnerability is patched. The vendor has provided an official fix, and upgrading is the recommended remediation.