Executive brief
pnpm, a popular JavaScript package manager, contains a vulnerability in its 'patch-remove' command. An attacker could provide a specially crafted project configuration that causes the tool to delete files outside of the intended project directory. This could lead to the accidental or malicious deletion of important system or user files when a developer runs the command.
Technical details
A path traversal vulnerability exists in the `patch-remove` command of pnpm. The root cause is insufficient validation of paths within the `patchedDependencies` configuration, allowing entries to resolve outside the intended patches directory. An attacker can exploit this by crafting a malicious package configuration that uses parent directory traversal (..) or absolute paths. When a user executes `pnpm patch-remove`, the tool may unlink arbitrary files reachable by the user's permissions, including those outside the project root. The vulnerability also affects how symlinks are handled, potentially leading to the deletion of targets even if they are dangling. The issue is fixed in versions 10.34.4 and 11.7.0 by implementing component-aware containment checks and canonicalizing parent directories before deletion.
Affected products
- pnpm pnpm < 10.34.4, >= 11.0.0 < 11.7.0
Timeline
- 2026-06-22: disclosed: Advisory published by maintainers
- 2026-06-27: advisory: GitHub Advisory reviewed and updated
- 2026-06-12: patched: Fix committed to main branch