{
  "threat_severity" : "Moderate",
  "public_date" : "2026-01-26T22:03:33Z",
  "bugzilla" : {
    "description" : "pnpm: pnpm: Arbitrary file permission modification via directory traversal",
    "id" : "2433115",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2433115"
  },
  "cvss3" : {
    "cvss3_base_score" : "6.5",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
    "status" : "draft"
  },
  "cwe" : "CWE-22",
  "details" : [ "pnpm is a package manager. Prior to version 10.28.2, when pnpm processes a package's `directories.bin` field, it uses `path.join()` without validating the result stays within the package root. A malicious npm package can specify `\"directories\": {\"bin\": \"../../../../tmp\"}` to escape the package directory, causing pnpm to chmod 755 files at arbitrary locations. This issue only affects Unix/Linux/macOS. Windows is not affected (`fixBin` gated by `EXECUTABLE_SHEBANG_SUPPORTED`). Version 10.28.2 contains a patch.", "A flaw was found in pnpm, a package manager. When pnpm processes the `directories.bin` field of a package, it fails to properly validate the path, allowing a malicious npm package to specify a crafted path. This directory traversal vulnerability enables the package to escape its intended directory and modify file permissions (chmod 755) at arbitrary locations on the system. This issue primarily affects Unix, Linux, and macOS operating systems." ],
  "statement" : "This vulnerability is rated Moderate for Red Hat products as it allows a malicious npm package to perform path traversal, leading to arbitrary file permission modification (chmod 755) outside the intended package directory. This issue affects systems running pnpm on Unix/Linux-based Red Hat environments when processing untrusted npm packages.",
  "package_state" : [ {
    "product_name" : "Red Hat JBoss Enterprise Application Platform 8",
    "fix_state" : "Fix deferred",
    "package_name" : "org.keycloak-keycloak-parent",
    "cpe" : "cpe:/a:redhat:jboss_enterprise_application_platform:8"
  }, {
    "product_name" : "Red Hat JBoss Enterprise Application Platform Expansion Pack",
    "fix_state" : "Fix deferred",
    "package_name" : "org.keycloak-keycloak-parent",
    "cpe" : "cpe:/a:redhat:jbosseapxp"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-24131\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-24131\nhttps://github.com/pnpm/pnpm/commit/17432ad5bbed5c2e77255ca6d56a1449bbcfd943\nhttps://github.com/pnpm/pnpm/releases/tag/v10.28.2\nhttps://github.com/pnpm/pnpm/security/advisories/GHSA-v253-rj99-jwpq" ],
  "name" : "CVE-2026-24131",
  "mitigation" : {
    "value" : "To mitigate this issue, ensure that only trusted npm packages are used with `pnpm`. Avoid installing packages from untrusted or unverified sources to prevent the processing of malicious package `directories.bin` fields.",
    "lang" : "en:us"
  },
  "csaw" : false
}