Vulnerabilities
Projects
Vulnerability Disclosure
About Us
Contact Us
Mend.io Vulnerability Database
What is a CVE vulnerability ID? 
What is a WS vulnerability ID?
What is an MSC vulnerability ID?
New vulnerability? Tell us about it!
What is a WS vulnerability ID?
What is an MSC vulnerability ID?
We found results for “”
CVE-2026-24131
Good to know:
Date: January 26, 2026
pnpm is a package manager. Prior to version 10.28.2, when pnpm processes a package's "directories.bin" field, it uses "path.join()" without validating the result stays within the package root. A malicious npm package can specify ""directories": {"bin": "../../../../tmp"}" to escape the package directory, causing pnpm to chmod 755 files at arbitrary locations. This issue only affects Unix/Linux/macOS. Windows is not affected ("fixBin" gated by "EXECUTABLE_SHEBANG_SUPPORTED"). Version 10.28.2 contains a patch.
Severity Score
Related Resources (6)
Severity Score
Weakness Type (CWE)
Top Fix
Upgrade Version
Upgrade to version pnpm - 10.28.2;https://github.com/pnpm/pnpm.git - v10.28.2
CVSS v3.1
| Base Score: |
|
|---|---|
| Attack Vector (AV): | LOCAL |
| Attack Complexity (AC): | LOW |
| Privileges Required (PR): | NONE |
| User Interaction (UI): | REQUIRED |
| Scope (S): | UNCHANGED |
| Confidentiality (C): | HIGH |
| Integrity (I): | NONE |
| Availability (A): | NONE |