Security readout for executives and security teams
Plain-English summary
CVE-2026-23890 affects pnpm before 10.28.1. A malicious npm package can abuse how pnpm creates command-line binaries during install, causing files to be created outside the expected node_modules/.bin directory. The main business risk is unwanted modification or creation of project or CI files during dependency installation.
Executive priority
Treat as a near-term developer tooling update. It is not reported as actively exploited, but it affects software supply-chain integrity. Prioritize CI/CD runners and repositories that install npm packages automatically or accept external dependency changes.
Technical view
pnpm’s bin-linking logic allowed scoped bin names beginning with @ to bypass validation. After scope normalization, traversal sequences could remain and direct shim or symlink creation outside node_modules/.bin. The advisory maps this to CWE-23 and CVSS 6.5, with high integrity impact and user interaction through package installation.
Likely exposure
Exposure applies to users and CI/CD pipelines running pnpm versions before 10.28.1 when installing npm packages, especially untrusted, newly added, or compromised dependencies. Systems not using pnpm, or already on 10.28.1 or later, are not indicated as affected by the provided sources.
Exploitation context
The sources describe a malicious package install scenario, not remote unauthenticated compromise of a running service. CISA KEV status is false in the provided bundle, and no cited source claims active exploitation. Impact is mainly arbitrary file creation or overwrite during dependency installation.
Researcher notes
The provided evidence identifies the vulnerable component, affected version range, patched version, and general vulnerability mechanism. It does not provide evidence of exploitation in the wild. Avoid assuming impact beyond file creation or overwrite outside node_modules/.bin unless confirmed in a specific environment.
Mitigation direction
- Upgrade pnpm to version 10.28.1 or later.
- Review vendor advisory GHSA-xpqm-wm3m-f34h for current guidance.
- Restrict installation of untrusted npm packages in developer and CI environments.
- Use dependency review processes for new or recently changed packages.
- Regenerate CI images or build containers that bundle vulnerable pnpm versions.
Validation and detection
- Inventory pnpm versions on developer workstations and CI runners.
- Check package manager lockfiles and build images for pnpm below 10.28.1.
- Confirm CI jobs use the upgraded pnpm binary at runtime.
- Review recent dependency additions before the pnpm upgrade.
- Inspect build workspaces for unexpected file changes after package installation.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-23: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-23890 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N2.83.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/pnpm/pnpm/security/advisories/GHSA-xpqm-wm3m-f34hCVE reference · x_refsource_CONFIRM
- https://github.com/pnpm/pnpm/commit/8afbb1598445d37985d91fda18abb4795ae5062dCVE reference · x_refsource_MISC
- https://github.com/pnpm/pnpm/releases/tag/v10.28.1CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Relative Path Traversal
Relative Path Traversal represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.