CVE-2026-50015

pnpm: Arbitrary File Write/Delete via Malicious Patch File (Path Traversal)

Published Jun 25, 2026 CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Description

pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm's patch application pipeline (@pnpm/patch-package) performs no path validation on file paths extracted from .patch files. An attacker who contributes a malicious patch file via a pull request can write attacker-controlled content to or delete arbitrary files on the filesystem during pnpm install, as the user running the install. The diff --git header paths containing ../../ sequences traverse out of the package directory, and the traversal is difficult to catch in code review because patch file diff headers are opaque to most reviewers. This vulnerability is fixed in 10.34.0 and 11.4.0.

Analysis

Technical impact

The vulnerability allows an attacker to write or delete arbitrary files during pnpm install, leading to potential compromise of the entire project repository. It manifests through path traversal in patch file headers that bypass file path validation, exposing the container or host filesystem to modification. This is a file system manipulation weakness classified as CWE-22.

Affected Systems

pnpm versions prior to 10.34.0 and 11.4.0 are affected. The vulnerability exists in the @pnpm/patch-package module used by pnpm, a popular JavaScript package manager. Users running pnpm install in a repository that accepts patches from pull requests are at risk if the package manager is not updated.

Risk and Exploitability

The CVSS score of 7.3 indicates high severity, but the EPSS score is not available, so the current probability of exploitation is unclear. The vulnerability is not listed in the CISA KEV catalog. The attack vector relies on a malicious patch file that is submitted via a pull request, making it likely that project maintainers can exploit the flaw by accepting a PR that contains a crafted .patch file. Because the path traversal in the diff header is opaque to most code reviews, an attacker can evade manual detection and immediately write or delete critical files during dependency installation.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

pnpm

affected

Version	Status	Constraints
`< 10.33.4`	affected	—
`>= 11.0.0, < 11.4.0`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:pnpm:pnpm::::::node.js::*
	cpe:2.3:a:pnpm:pnpm::::::node.js::*

No data.

Vendor Product Versions

Pnpm

Version	Status	Scheme	Platform
`[0,10.33.4)`	affected	semver	—
`[11.0.0,11.4.0)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade pnpm to 10.34.0 or later, or to 11.4.0 or later, to apply the path validation fix
If an upgrade cannot be performed immediately, deny or reject pull requests that contain patch files, or manually review and sanitize patch headers to remove any '../../' sequences before application
Disable or remove the @pnpm/patch-package module from the project if patches are not required, ensuring that no unvalidated patch content can be applied

Generated by OpenCVE AI on June 25, 2026 at 18:24 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-rxhj-4m44-96r4	pnpm Vulnerable to Arbitrary File Write/Delete via Malicious Patch File (Path Traversal)

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.428% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/pnpm/pnpm/security/advisories/GHSA-rxhj-4m44-96r4
https://nvd.nist.gov/vuln/detail/CVE-2026-50015
https://www.cve.org/CVERecord?id=CVE-2026-50015

History

Jul 7, 2026 12:15 AM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-50015 https://www.cve.org/CVERecord?id=CVE-2026-50015
Metrics	threat_severity `None`	threat_severity `Important`

Jun 25, 2026 9:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Pnpm Pnpm pnpm
Vendors & Products		Pnpm Pnpm pnpm

Jun 25, 2026 6:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 25, 2026 5:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm's patch application pipeline (@pnpm/patch-package) performs no path validation on file paths extracted from .patch files. An attacker who contributes a malicious patch file via a pull request can write attacker-controlled content to or delete arbitrary files on the filesystem during pnpm install, as the user running the install. The diff --git header paths containing ../../ sequences traverse out of the package directory, and the traversal is difficult to catch in code review because patch file diff headers are opaque to most reviewers. This vulnerability is fixed in 10.34.0 and 11.4.0.
Title		pnpm: Arbitrary File Write/Delete via Malicious Patch File (Path Traversal)
Weaknesses		CWE-22
References		https://github.com/pnpm/pnpm/security/advisories/GHSA-rxhj-4m44-96r4
Metrics		cvssV3_1 `{'score': 7.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H'}`