CVE-2026-59194: pnpm Path Traversal in Patch Removal – HIGH Severity

Technical summary

CVE-2026-59194 stems from inadequate path validation in pnpm's patch handling mechanism. When processing patch entries, the application fails to properly constrain file operations to the designated patches directory. An attacker can exploit CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) by injecting directory traversal sequences (e.g., '../') into a patch entry. When `pnpm patch-remove` executes, it resolves the crafted path outside the sandbox and deletes the target file. The vulnerability also relates to CWE-73 (External Control of File Name or Path), as the patch entry directly influences which filesystem paths are accessed without sufficient sanitization.

Business impact

Organizations using pnpm in development workflows face risk of accidental or intentional data loss. If a dependency package contains a malicious patch configuration, or if an attacker can modify patch files in a shared repository, critical project files, build artifacts, or even system files could be deleted when developers run `pnpm patch-remove`. In CI/CD environments where pnpm runs with elevated privileges, the blast radius expands. This can disrupt deployments, compromise build integrity, and in worst-case scenarios, destroy configuration or credential files.

Affected systems

All pnpm versions prior to 10.34.4 and 11.7.0 are vulnerable. This includes the entire 10.x line up to 10.34.3 and the 11.x line up to 11.6.9. The vulnerability manifests only when a user executes `pnpm patch-remove`, so attack surface is limited to active patch workflows. Development environments, CI/CD pipelines, and any system where pnpm is used to manage JavaScript dependencies are potential targets.

Exploitability

The vulnerability requires user interaction (running `pnpm patch-remove`), which moderates exploitability in some contexts but not others. In shared development environments, supply chain attacks, or automated CI/CD scenarios, user interaction may be implicit or unavoidable. An attacker could embed a malicious patch entry in a dependency, documentation, or pull request. The CVSS score of 7.1 (HIGH) reflects the high integrity impact (arbitrary file deletion) offset by the requirement for user action and network-based attack vector limitations. No evidence of active exploitation in the wild exists as of publication.

Remediation

Upgrade pnpm immediately to version 10.34.4 (for 10.x users) or 11.7.0 (for 11.x users). Verify the upgrade by running `pnpm --version` and confirm the patched version is in use. Additionally, audit patch configurations in your project repositories—examine `.pnpmfile.cjs` and any patch entries for suspicious or unexpected paths. In the interim, restrict use of `pnpm patch-remove` and manually manage patch files if necessary.

Patch guidance

Patch availability: pnpm 10.34.4 and 11.7.0 or later. Deployment priority: High—apply within 1–2 weeks depending on your patch cycle. For Node.js environments, pnpm is typically installed as a project dependency or global tool. Update via `npm install -g pnpm@latest` for global installations, or update your package.json and lockfile for project-level dependencies. Test in a non-production environment first, especially if your build process relies on patch operations. Verify no breakage in patch workflows before rollout.

Detection guidance

Monitor pnpm execution logs and filesystem audit logs for `patch-remove` commands, especially with unusual file paths or successful deletions outside expected directories. In CI/CD, capture stderr/stdout from pnpm invocations. Use file integrity monitoring (FIM) tools to detect unexpected deletions in sensitive directories during or after pnpm runs. Review dependency pull requests and patch configurations for suspicious path entries containing traversal sequences (../, ..\ etc.). If you suspect compromise, inspect recent commits to .pnpmfile.cjs or patch-related configuration files.

Why prioritize this

This vulnerability merits immediate attention because: (1) pnpm is a core tool in JavaScript/Node.js ecosystems with broad adoption; (2) file deletion is a high-integrity impact with potential for lasting damage; (3) CI/CD automation amplifies risk by executing `patch-remove` without direct human oversight; (4) supply chain attack vectors are realistic if patch configurations can be poisoned upstream. Although KEV status is not active, the ease of exploitation for targeted attacks and the breadth of affected users justifies urgent patching.

Risk score, explained

The CVSS 3.1 score of 7.1 (HIGH) is driven by: high impact on integrity (arbitrary file deletion, scoring 'H'), medium impact on availability (service disruption via deleted files, scoring 'L'), and no confidentiality impact. The attack vector is network (AV:N) because patches can be sourced from remote repositories or shared environments. Attack complexity is low (AC:L)—no special conditions needed once a malicious patch is in place. Privilege escalation is not required (PR:N), but user interaction is mandatory (UI:R), which prevents a CRITICAL rating. The scope is unchanged (S:U), meaning the impact is limited to the vulnerable component and calling process.

Frequently asked questions