CVE-2026-59194

[CVE catalog]

Severity

High · CVSS 7.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

Published

Jul 6, 2026, 3:16:28 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.40% · Oct 25, 2026

A flaw was found in pnpm, a package manager. A remote attacker could exploit this vulnerability by providing a specially crafted patch entry. This crafted entry could resolve outside the configured patches directory, allowing for the deletion of an arbitrary file when `pnpm patch-remove` is executed. This could lead to data integrity issues or a denial of service. pnpm: pnpm: patch-remove could delete project-selected files outside the patches directory This is an Important flaw in `pnpm` where a crafted patch entry can enable arbitrary file deletion. When the `pnpm patch-remove` command processes such an entry, it may resolve paths outside the intended patches directory, allowing the deletion of arbitrary files. While the primary issue is addressed by validating paths, a local attacker could still exploit a time-of-check/time-of-use race condition to achieve similar effects. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.