Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-07-06T15:16:28 pnpm: pnpm: patch-remove could delete project-selected files outside the patches directory 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L CWE-22

pnpm is a package manager. Prior to 10.34.4 and 11.7.0, a crafted patch entry could resolve outside the configured patches directory and cause pnpm patch-remove to delete an arbitrary reachable file. This vulnerability is fixed in 10.34.4 and 11.7.0.

A flaw was found in pnpm, a package manager. A remote attacker could exploit this vulnerability by providing a specially crafted patch entry. This crafted entry could resolve outside the configured patches directory, allowing for the deletion of an arbitrary file when `pnpm patch-remove` is executed. This could lead to data integrity issues or a denial of service.

This is an Important flaw in `pnpm` where a crafted patch entry can enable arbitrary file deletion. When the `pnpm patch-remove` command processes such an entry, it may resolve paths outside the intended patches directory, allowing the deletion of arbitrary files. While the primary issue is addressed by validating paths, a local attacker could still exploit a time-of-check/time-of-use race condition to achieve similar effects. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat AMQ Broker 7 Not affected pnpm Red Hat Build of Keycloak Affected pnpm Red Hat JBoss Enterprise Application Platform 8 Not affected pnpm Red Hat JBoss Enterprise Application Platform Expansion Pack Not affected pnpm https://www.cve.org/CVERecord?id=CVE-2026-59194 https://nvd.nist.gov/vuln/detail/CVE-2026-59194 https://github.com/pnpm/pnpm/security/advisories/GHSA-72r4-9c5j-mj57