ALPINE-CVE-2026-23890
- Source
- https://security.alpinelinux.org/vuln/CVE-2026-23890
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/alpine/ALPINE-CVE-2026-23890.json
- JSON Data
- https://api.osv.dev/v1/vulns/ALPINE-CVE-2026-23890
- Upstream
- Published
- 2026-01-26T22:15:56Z
- Modified
- 2026-11-03T06:33:01Z
- Severity
-
- 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVSS Calculator
- Summary
- [none]
- Details
-
pnpm is a package manager. Prior to version 10.28.1, a path traversal vulnerability in pnpm's bin linking allows malicious npm packages to create executable shims or symlinks outside of
node_modules/.bin. Bin names starting with@bypass validation, and after scope normalization, path traversal sequences like../../remain intact. This issue affects all pnpm users who install npm packages and CI/CD pipelines using pnpm. It can lead to overwriting config files, scripts, or other sensitive files. Version 10.28.1 contains a patch. - References