CVE-2026-23888 pnpm: Binary ZIP extraction allows arbitrary file write via path traversal (Zip Slip)

pnpm is a package manager. Prior to version 10.28.1, a path traversal vulnerability in pnpm's binary fetcher allows malicious packages to write files outside the intended extraction directory. The vulnerability has two attack vectors: 1 Malicious ZIP entries containing ../ or absolute paths that...

@designid/tokens (0.1.1), @directus/vue-split-panel (>=0.1.0, <=0.8.2) +10 more potentially affected by CVE-2026-23888 via pnpm (>=10.0.0, <=10.18.3)

pnpm NPM version =10.0.0, =0.1.0, =1.1.1, =3.7.16, =0.1.8, =0.1.0, =2.7.2, =0.2.5, =1.0.4, =1.0.7 Source cves: CVE-2026-23888 Source advisory: OSV:GHSA-6PFH-P556-V868...

@kcconfigs/commitlint (>=0.1.0-beta.2, <=0.2.0), @pnpm/cache.commands (>=1000.0.52, <=1000.0.54) +35 more potentially affected by CVE-2026-23888 via @pnpm/fetching.binary-fetcher (>=1005.0.0, <=1005.0.1)

@pnpm/fetching.binary-fetcher NPM version =1005.0.0, =0.1.0-beta.2, =1000.0.52, =1001.2.17, =1001.1.13, =1016.0.0, =1002.2.21, =1003.0.24, =1002.0.3, =1000.0.52, =1001.0.16, =1001.1.10, =1002.1.28, =1000.3.8, =1002.0.23, =1000.1.51, =1000.1.53 and more Source cves: CVE-2026-23888 Source advisory:...