CVE-2026-23888

npm/pnpm CVE-2026-23888: medium 6.5, EPSS 0.45%

pnpm: Binary ZIP extraction allows arbitrary file write via path traversal (Zip Slip)

Action: Upgrade pnpm to 10.28.1 or later.

npm i pnpm@10.28.1

Affected

Fixed versions

Sources

• osv: GHSA-6pfh-p556-v868
• https://github.com/pnpm/pnpm/security/advisories/GHSA-6pfh-p556-v868
• https://nvd.nist.gov/vuln/detail/CVE-2026-23888
• https://github.com/pnpm/pnpm/commit/5c382f0ca3b7cc49963b94677426e66539dcb3f5
• https://github.com/pnpm/pnpm
• https://github.com/pnpm/pnpm/releases/tag/v10.28.1

CVE-2026-23888 · published 2026-01-26T21:02:49Z · modified 2026-02-03T03:06:45.887995Z · JSON