https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 02:53:33 +0000 https://db.gcve.eu/vuln/cve-2026-23890 <p><strong>Affected:</strong> pnpm</p> <p>pnpm is a package manager. Prior to version 10.28.1, a path traversal vulnerability in pnpm&#39;s bin linking allows malicious npm packages to create executable shims or symlinks outside of `node_modules/.bin`. Bin names starting with `@` bypass validation, and after scope normalization, path traversal sequences like `../../` remain intact. This issue affects all pnpm users who install npm packages and CI/CD pipelines using pnpm. It can lead to overwriting config files, scripts, or other sensitive files. Version 10.28.1 contains a patch.</p> <p><strong>Affected:</strong> pnpm</p> <p>pnpm is a package manager. Prior to version 10.28.1, a path traversal vulnerability in pnpm&#39;s bin linking allows malicious npm packages to create executable shims or symlinks outside of `node_modules/.bin`. Bin names starting with `@` bypass validation, and after scope normalization, path traversal sequences like `../../` remain intact. This issue affects all pnpm users who install npm packages and CI/CD pipelines using pnpm. It can lead to overwriting config files, scripts, or other sensitive files. Version 10.28.1 contains a patch.</p> https://db.gcve.eu/vuln/cve-2026-23890 https://db.gcve.eu/vuln/ghsa-xpqm-wm3m-f34h <p><strong>Affected:</strong> npm: pnpm</p> <p>### Summary A path traversal vulnerability in pnpm&#39;s bin linking allows malicious npm packages to create executable shims or symlinks outside of `node_modules/.bin`. Bin names starting with `@` bypass validation, and after scope normalization, path traversal sequences like `../../` remain intact.</p> <p>### Details The vulnerability exists in the bin name validation and normalization logic:</p> <p>**1. Validation Bypass (`pkg-manager/package-bins/src/index.ts`)**</p> <p>The filter allows any bin name starting with `@` to pass through without validation:</p> <p>```typescript .filter((commandName) =&gt; encodeURIComponent(commandName) === commandName || commandName === &#39;&#39; || commandName[0] === &#39;@&#39; // &lt;-- Bypasses validation ) ```</p> <p>**2. Incomplete Normalization (`pkg-manager/package-bins/src/index.ts`)**</p> <p>```typescript function normalizeBinName (name: string): string { return name[0] === &#39;@&#39; ? name.slice(name.indexOf(&#39;/&#39;) + 1) : name } // Input: @scope/../../evil // Output: ../../evil &lt;-- Path traversal preserved! ```</p> <p>**3. Exploitation (`pkg-manager/link-bins/src/index.ts:288`)**</p> <p>The normalized name is used directly in `path.join()` without validation.</p> <p>### PoC 1. Create a malicious package: ```json { &#34;name&#34;: &#34;malicious-pkg&#34;, &#34;version&#34;: &#34;1.0.0&#34;, &#34;bin&#34;: { &#34;@scope/../../.npmrc&#34;: &#34;./malicious.js&#34; } } ```</p> <p>2. Install the package: ```bash pnpm add /path/to/malicious-pkg ```</p> <p>3. Observe `.npmrc` created in project root (outside node_modules/.bin).</p> <p>### Impact - All pnpm users who insta…</p> <p><strong>Affected:</strong> npm: pnpm</p> <p>### Summary A path traversal vulnerability in pnpm&#39;s bin linking allows malicious npm packages to create executable shims or symlinks outside of `node_modules/.bin`. Bin names starting with `@` bypass validation, and after scope normalization, path traversal sequences like `../../` remain intact.</p> <p>### Details The vulnerability exists in the bin name validation and normalization logic:</p> <p>**1. Validation Bypass (`pkg-manager/package-bins/src/index.ts`)**</p> <p>The filter allows any bin name starting with `@` to pass through without validation:</p> <p>```typescript .filter((commandName) =&gt; encodeURIComponent(commandName) === commandName || commandName === &#39;&#39; || commandName[0] === &#39;@&#39; // &lt;-- Bypasses validation ) ```</p> <p>**2. Incomplete Normalization (`pkg-manager/package-bins/src/index.ts`)**</p> <p>```typescript function normalizeBinName (name: string): string { return name[0] === &#39;@&#39; ? name.slice(name.indexOf(&#39;/&#39;) + 1) : name } // Input: @scope/../../evil // Output: ../../evil &lt;-- Path traversal preserved! ```</p> <p>**3. Exploitation (`pkg-manager/link-bins/src/index.ts:288`)**</p> <p>The normalized name is used directly in `path.join()` without validation.</p> <p>### PoC 1. Create a malicious package: ```json { &#34;name&#34;: &#34;malicious-pkg&#34;, &#34;version&#34;: &#34;1.0.0&#34;, &#34;bin&#34;: { &#34;@scope/../../.npmrc&#34;: &#34;./malicious.js&#34; } } ```</p> <p>2. Install the package: ```bash pnpm add /path/to/malicious-pkg ```</p> <p>3. Observe `.npmrc` created in project root (outside node_modules/.bin).</p> <p>### Impact - All pnpm users who insta…</p> https://db.gcve.eu/vuln/ghsa-xpqm-wm3m-f34h