pnpm has Windows-specific tarball Path Traversal (CVE-2026-23889)

pnpm, a package manager, has a path traversal vulnerability (CVE-2026-23889) affecting Windows platforms due to improper path normalization during tarball extraction. The vulnerability occurs because the normalization logic fails to handle Windows backslash separators, allowing crafted packages to write files outside the package directory. This can overwrite important files like .npmrc or build configs, potentially disrupting builds or altering configurations. The vulnerability is fixed in pnpm version 10.28.1.

On Windows systems, malicious packages can exploit this vulnerability to write or overwrite files outside the package directory, including sensitive configuration files such as .npmrc and build configuration files. This can lead to compromised build environments or altered package manager behavior. The vulnerability affects Windows users and Windows-based CI/CD pipelines (e.g., GitHub Actions Windows runners, Azure DevOps). There is no indication of confidentiality or availability impact, but integrity impact is high.

Upgrade pnpm to version 10.28.1 or later, which contains the official patch addressing this Windows-specific path traversal vulnerability. Users should ensure their CI/CD pipelines and development environments on Windows are updated accordingly. No additional mitigations are indicated by the vendor advisory.