Executive brief
pnpm is a popular JavaScript package manager used to install and manage software dependencies. A vulnerability in how it handles "patch" files allows a specially crafted project file to delete arbitrary files on a user's computer when they run the "patch-remove" command. This could lead to data loss or system instability if critical files are deleted.
Technical details
A path traversal vulnerability (CWE-22) exists in the pnpm package manager's 'patch-remove' command. The root cause is improper validation of 'patchedDependencies' paths, which allows a crafted entry to resolve to locations outside the intended patches directory. An attacker can exploit this by providing a malicious project configuration that, when processed by a user running 'pnpm patch-remove', deletes arbitrary files reachable by the user's permissions. The vulnerability also involves improper handling of symlinks and dangling targets during the deletion process. This issue is fixed in versions 10.34.4 and 11.7.0 by implementing component-aware containment checks and canonicalizing parent directories before unlinking.
Affected products
- pnpm pnpm < 10.34.4, >= 11.0.0 < 11.7.0
Timeline
- 2026-06-22: advisory: GitHub Security Advisory published
- 2026-07-06: disclosed: NVD publication date