pnpm CVE-2026-50015

Exploitation requires that the target project uses pnpm's patch feature (a .patch file referenced via patchedDependencies in package.json) and that a victim with filesystem write privileges runs pnpm install against the attacker's contributed patch - typically after accepting or checking out a malicious pull request. The concrete prerequisite is an attacker-controlled .patch file whose diff --git/diff header path contains ../ traversal sequences; the impact is bounded to files writable by the install user. Limiting factors (UI:R in the CVSS vector): the attack is not automatic or self-propagating - a human maintainer must merge or check out the branch and trigger install, the project must actually consume patch files, and damage is confined to the privileges of the installing account, making this a targeted supply-chain vector rather than unauthenticated remote compromise of a running service.

Signals are partially conflicting and should be read together. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H, 7.3) indicates a network-reachable, low-complexity attack with high integrity and availability impact but no confidentiality loss, gated by required user interaction (a maintainer running install) - consistent with the supply-chain / pull-request delivery model described. No EPSS score was provided, the CVE is not in CISA KEV, and no POC was referenced, so there is no evidence of active or imminent mass exploitation; this is best treated as a targeted, social-engineering-dependent threat rather than a wormable internet-facing bug. The PR:L in the vendor vector is debatable - submitting a public pull request requires no privileges on the victim's system, so an argument for PR:N (raising the score) exists, while the real limiting factor is UI:R: a maintainer must actually check out the branch and run install. Net: a genuine and credible supply-chain risk for projects that accept external patch contributions, but lower urgency than a high CVSS alone would imply because exploitation hinges on a human merging/running untrusted patch files.

An attacker opens a pull request to a target repository that adds or modifies a .patch file referenced by patchedDependencies, with a diff --git header path containing ../../ that points at a sensitive file such as a CI script, SSH config, or shell profile. A maintainer reviews the PR, sees a plausible dependency patch, checks out the branch and runs pnpm install; pnpm applies the patch and writes attacker-controlled content to (or deletes) the out-of-tree target as the maintainer/CI user. No public POC is referenced, but the technique is straightforward and reliable (AC:L) once a victim is induced to install.