pnpm scoped bin name Path Traversal allows arbitrary file creation outside node_modules/.bin (CVE-2026-23890)

pnpm versions before 10.28.1 contain a path traversal vulnerability in the bin linking mechanism. Specifically, malicious npm packages can exploit bin names starting with '@' to bypass validation and use path traversal sequences such as '../../' after scope normalization. This allows creation of executable shims or symlinks outside the node_modules/.bin directory, potentially overwriting critical files. The vulnerability affects all users installing npm packages with pnpm and CI/CD pipelines using pnpm. The issue is fixed in version 10.28.1.

The vulnerability allows an attacker to create or overwrite executable files outside the intended directory, which can lead to modification of configuration files, scripts, or other sensitive files. This can compromise the integrity of the system or build environment. There is no indication of confidentiality or availability impact. The CVSS score is 6.5 (medium severity), reflecting the potential for integrity impact without requiring privileges or user interaction beyond package installation.

Users should upgrade pnpm to version 10.28.1 or later, where the vulnerability is patched. The vendor has released an official fix, and applying this update will remediate the issue. No additional mitigations are specified or required beyond applying the patch.