CVE-2026-59194: Pnpm Path Traversal Vulnerability

CVE-2026-59194 Overview

CVE-2026-59194 is a path traversal vulnerability [CWE-22] in pnpm, a JavaScript package manager widely used in Node.js development environments. Versions prior to 10.34.4 and 11.7.0 fail to properly constrain patch entry resolution to the configured patches directory. A crafted patch entry can escape this directory and cause the pnpm patch-remove command to delete an arbitrary reachable file on the host filesystem. The issue is fixed in 10.34.4 and 11.7.0.

Critical Impact
An attacker who convinces a developer or CI system to run pnpm patch-remove against a malicious project can delete arbitrary files reachable by the invoking user, impacting integrity and availability.

Affected Products

pnpm versions prior to 10.34.4 (10.x branch)
pnpm versions prior to 11.7.0 (11.x branch)
Node.js projects consuming untrusted pnpm configuration or patch entries

Discovery Timeline

2026-07-06 - CVE-2026-59194 published to NVD
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-59194

Vulnerability Analysis

The vulnerability resides in the pnpm patch-remove workflow, which is responsible for removing patch files that override installed dependencies. pnpm expects patch entries to be resolved beneath the configured patches directory, but the resolver does not enforce that constraint. An entry containing traversal sequences such as ../ resolves to paths outside the patches directory. When patch-remove acts on that entry, it deletes the resolved target rather than the intended patch file.

Exploitation requires user interaction, typically a developer running pnpm patch-remove inside a repository or workspace controlled by an attacker. The attacker supplies a crafted pnpm configuration or patch entry, and the tool performs the delete under the developer's own privileges. Confidentiality is not directly impacted, but integrity is high because arbitrary reachable files can be destroyed. Availability is degraded when critical project, system, or CI artifacts are removed.

Root Cause

The root cause is missing canonicalization and containment checks on patch entry paths before filesystem operations. pnpm treats the entry as trusted input and joins it against the patches directory without verifying that the resolved absolute path remains inside that directory. This is a classic [CWE-22] Improper Limitation of a Pathname to a Restricted Directory.

Attack Vector

The attack vector is network-adjacent through supply chain distribution. An attacker publishes or contributes a repository, workspace, or package containing a crafted patch reference. When a victim clones the project and executes pnpm patch-remove, the tool follows the traversal and deletes files outside the patches directory. In CI environments, the deleted files may include build outputs, credentials cached on disk, or shared runner state.

See the pnpm GitHub Security Advisory GHSA-72r4-9c5j-mj57 for maintainer details.

Detection Methods for CVE-2026-59194

Indicators of Compromise

Unexpected file deletions on developer workstations or CI runners shortly after execution of pnpm patch-remove.
Patch entries in package.json, pnpm-workspace.yaml, or .pnpmfile.cjs containing ../ sequences or absolute paths.
Repositories referencing patch files that resolve outside the configured patches directory.

Detection Strategies

Inspect repositories for patch entries whose resolved path escapes the configured patches directory before running pnpm commands.
Compare installed pnpm versions across developer and build systems against fixed versions 10.34.4 and 11.7.0.
Audit CI job logs for invocations of pnpm patch-remove followed by filesystem errors or missing artifact warnings.

Monitoring Recommendations

Log and alert on pnpm patch-remove executions in CI/CD pipelines and correlate with subsequent file deletion events.
Monitor endpoint filesystem telemetry for unlink operations initiated by node or pnpm processes targeting paths outside project directories.
Track dependency manifest changes in code review to flag suspicious patch entries prior to merge.

How to Mitigate CVE-2026-59194

Immediate Actions Required

Upgrade pnpm to 10.34.4 or 11.7.0 or later on all developer workstations, build agents, and container images.
Avoid running pnpm patch-remove inside untrusted repositories until upgrades are confirmed.
Review recent uses of pnpm patch-remove in CI logs to identify potential file loss and restore from backups where needed.

Patch Information

The pnpm maintainers released fixes in versions 10.34.4 and 11.7.0. These releases enforce that patch entries resolve within the configured patches directory. Details are published in the pnpm GitHub Security Advisory GHSA-72r4-9c5j-mj57.

Workarounds

Pin CI and developer environments to trusted pnpm versions and block execution of pnpm patch-remove in automation until patched.
Run pnpm commands as low-privilege users inside sandboxed containers or ephemeral CI runners to limit the scope of reachable files.
Enforce code review on any changes to patch directories and pnpm configuration files that introduce new patch entries.

bash

# Upgrade pnpm to a fixed release
npm install -g pnpm@11.7.0
# or for the 10.x branch
npm install -g pnpm@10.34.4

# Verify the installed version
pnpm --version