Path traversal in pnpm - CVE-2026-24131
Published: April 27, 2026
Vulnerability identifier: #VU128180
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-24131
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to modify file permissions for arbitrary files.
The vulnerability exists due to path traversal in pkg-manager/package-bins/src/index.ts when processing a package's directories.bin field. A remote attacker can supply a specially crafted package to modify file permissions for arbitrary files.
Only Unix, Linux, and macOS systems are affected. Dotfiles are excluded by the default tinyglobby behavior.
Affected software
pnpm
How to mitigate CVE-2026-24131
Install security update from vendor's website.
pnpm - update to 10.28.2