Path Traversal in pnpm via Crafted Patch Entry

Executive Summary

CVE-2026-59194 is a high-severity vulnerability in the pnpm package manager affecting versions below 10.34.4 and between 11.0.0 to 11.7.0.

The vulnerability involves the `patch-remove` command, which could be exploited by crafting a patch entry that resolves outside the configured patches directory.

This improper validation allows the command to delete arbitrary reachable files outside the intended directory, enabling path traversal attacks through symlinks or absolute paths.

The fix ensures stricter validation by canonicalizing parent directories and preventing directory traversal, Windows drive escapes, and UNC escapes before deleting any files.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker to delete arbitrary files on the system where pnpm is used.

Such unauthorized file deletion can compromise system integrity by removing critical files, potentially disrupting applications or system operations.

Because the attack vector is network-based and requires low complexity, it poses a significant risk without needing user interaction.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves the pnpm patch-remove command deleting arbitrary files due to improper path validation. Detection would involve checking the version of pnpm installed and monitoring usage of the patch-remove command for suspicious or crafted patch entries that attempt path traversal.

Specifically, you can detect vulnerable versions by running the command to check pnpm version:

• pnpm --version

If the version is below 10.34.4 or between 11.0.0 and 11.7.0, the system is vulnerable.

Additionally, you can audit patch entries used with patch-remove for any that contain absolute paths, parent directory traversal sequences (e.g., "../"), or symlinks that resolve outside the configured patches directory.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade pnpm to a fixed version where this vulnerability is resolved.

• Upgrade pnpm to version 10.34.4 or later, or to version 11.7.0 or later.

Until the upgrade is applied, avoid using the patch-remove command with untrusted or crafted patch entries that could exploit path traversal.

Ensure that any patch-remove operations are performed with trusted inputs and consider restricting access to the pnpm patch-remove functionality to trusted users only.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an attacker to delete arbitrary files outside the intended patches directory, potentially impacting system integrity.

While the provided information does not explicitly mention compliance with standards such as GDPR or HIPAA, unauthorized deletion of critical files could lead to data loss or disruption of systems that handle sensitive information, which may indirectly affect compliance with such regulations.

Organizations relying on pnpm in affected versions should consider the risk of data integrity and availability impacts when assessing their compliance posture.

Useful 0 Not Useful 0