CVE-2026-50015

[CVE catalog]

Severity

High · CVSS 7.3CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H

Published

Jun 25, 2026, 4:52:01 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.43% · Oct 27, 2026

A flaw was found in pnpm. An attacker can exploit this by contributing a malicious patch file through a pull request. During the pnpm install process, the patch application pipeline fails to validate file paths extracted from these patch files. This allows the attacker to write or delete arbitrary files on the filesystem, potentially leading to arbitrary code execution or privilege escalation on the system where pnpm install is executed. pnpm: pnpm: Arbitrary file write/delete due to lack of path validation in patch files This is an Important vulnerability in pnpm, a package manager utilized across several Red Hat products. The flaw enables an attacker to perform arbitrary file write or deletion on the filesystem during the `pnpm install` process by introducing a specially crafted patch file. This is due to insufficient path validation within the patch application pipeline, allowing directory traversal and potentially leading to arbitrary code execution or privilege escalation on the system where the installation is performed. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.