CVE-2026-59194

HighCVSS 7.1

Published: 06/07/2026(UTC)Updated: 07/07/2026(UTC)Translated: 08/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

17th percentile - higher than 17% of all known CVEs

Summary

In pnpm prior to versions 10.34.4 and 11.7.0, a crafted patch entry could resolve outside the configured patches directory, allowing arbitrary file deletion via the pnpm patch-remove command.

Risk Assessment

An attacker could exploit this vulnerability to delete critical system or application files, potentially causing service disruption or data loss.

Recommendation

Immediately update pnpm to version 10.34.4 or 11.7.0, which contain the fix for this vulnerability.

Original NVD description (English source)

pnpm is a package manager. Prior to 10.34.4 and 11.7.0, a crafted patch entry could resolve outside the configured patches directory and cause pnpm patch-remove to delete an arbitrary reachable file. This vulnerability is fixed in 10.34.4 and 11.7.0.