{
  "threat_severity" : "Moderate",
  "public_date" : "2026-01-26T21:53:40Z",
  "bugzilla" : {
    "description" : "pnpm: pnpm: Arbitrary code execution via path traversal in bin linking",
    "id" : "2433090",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2433090"
  },
  "cvss3" : {
    "cvss3_base_score" : "6.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
    "status" : "draft"
  },
  "cwe" : "CWE-23",
  "details" : [ "pnpm is a package manager. Prior to version 10.28.1, a path traversal vulnerability in pnpm's bin linking allows malicious npm packages to create executable shims or symlinks outside of `node_modules/.bin`. Bin names starting with `@` bypass validation, and after scope normalization, path traversal sequences like `../../` remain intact. This issue affects all pnpm users who install npm packages and CI/CD pipelines using pnpm. It can lead to overwriting config files, scripts, or other sensitive files. Version 10.28.1 contains a patch.", "A flaw was found in pnpm, a package manager. A remote attacker can exploit a path traversal vulnerability by crafting malicious npm packages. This vulnerability allows the attacker to bypass validation by using bin names starting with an \"@\" symbol, enabling them to create executable shims or symbolic links (symlinks) outside of the designated `node_modules/.bin` directory. This could lead to arbitrary code execution or privilege escalation on the affected system." ],
  "statement" : "This vulnerability is rated Moderate for Red Hat. It affects systems using pnpm where malicious npm packages can exploit a path traversal flaw during bin linking. This allows the creation of executable files or symlinks outside of the `node_modules/.bin` directory, posing a risk in environments that install untrusted npm packages, such as development or CI/CD pipelines.",
  "package_state" : [ {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 8",
    "fix_state" : "Fix deferred",
    "package_name" : "org.keycloak-keycloak-parent",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:8"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform Expansion Pack",
    "fix_state" : "Fix deferred",
    "package_name" : "org.keycloak-keycloak-parent",
    "cpe" : "cpe:/a:redhat:jbosseapxp"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-23890\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23890\nhttps://github.com/pnpm/pnpm/commit/8afbb1598445d37985d91fda18abb4795ae5062d\nhttps://github.com/pnpm/pnpm/releases/tag/v10.28.1\nhttps://github.com/pnpm/pnpm/security/advisories/GHSA-xpqm-wm3m-f34h" ],
  "name" : "CVE-2026-23890",
  "mitigation" : {
    "value" : "To mitigate this issue, ensure that only trusted npm packages are installed when utilizing pnpm. Restrict the use of pnpm for package installation to controlled environments, such as secure CI/CD pipelines, to prevent the introduction of malicious packages. Implement robust package source validation and integrity checks to minimize exposure.",
    "lang" : "en:us"
  },
  "csaw" : false
}