Executive brief
pnpm, a popular JavaScript package manager, is vulnerable to a security flaw in how it handles custom software patches. An attacker could submit a malicious patch file to a project that, when processed during a standard installation command, allows them to overwrite or delete sensitive files on the user's computer. This could lead to a full system compromise, such as by replacing security keys or modifying system configuration files.
Technical details
A path traversal vulnerability exists in pnpm's `@pnpm/patch-package` library due to insufficient validation of file paths in `.patch` files. The vulnerability occurs in the `applyPatchToDir` function where the patch parser extracts paths from `diff --git` headers using a regular expression without sanitizing for `../` sequences. An attacker can exploit this by providing a malicious patch file via a pull request; when a user runs `pnpm install`, the `executeEffects` function in `apply.js` uses these unsanitized paths to perform `fs.writeFileSync` or `fs.unlinkSync` operations. This allows for arbitrary file creation, modification, or deletion with the privileges of the user running the install. The issue is fixed in versions 10.34.0 and 11.4.0.
Affected products
- pnpm pnpm < 10.34.0, >= 11.0.0 < 11.4.0
Timeline
- 2026-05-28: disclosed
- 2026-06-25: advisory: NVD publication date
- 2026-06-26: patched: GitHub Advisory reviewed and updated with patched versions