What is the CVSS score of CVE-2026-59194?

CVE-2026-59194 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L. EPSS exploitation probability: 0.2%.

Which versions of pnpm are affected by CVE-2026-59194?

pnpm, a package manager critical to JavaScript development pipelines, contains an arbitrary file deletion vulnerability that allows malicious repositories to destroy any files accessible to…. A patch is available.

How to fix or mitigate CVE-2026-59194?

Within 24 hours: Alert development teams to avoid running 'pnpm patch-remove' against external or untrusted repositories; audit recent usage of this command for suspicious activity. Within 7 days: Inventory all pnpm installations and versions in use; restrict or disable 'pnpm patch-remove' in CI/CD systems and development environments through access controls and command blocking. Within 30 days: Monitor for vendor patch release targeting versions 10.34.4 and 11.7.0; plan mandatory upgrades to patched versions once available.

pnpm CVE-2026-59194

EUVD-2026-41881 HIGH

Path Traversal (CWE-22)

2026-07-06 GitHub_M

Path Traversal Red Hat Pnpm Suse

7.1

CVSS 3.1 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

vuln.today AI

7.1 HIGH

Malicious config is delivered remotely (AV:N) but requires the victim to run patch-remove (UI:R) with no auth (PR:N); arbitrary file deletion gives I:H with partial A:L and no confidentiality (C:N).

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.1 HIGH

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

Low

Lifecycle Timeline

Patch available

Jul 06, 2026 - 17:01 EUVD

Analysis Generated

Jul 06, 2026 - 16:41 vuln.today

DescriptionCVE.org

pnpm is a package manager. Prior to 10.34.4 and 11.7.0, a crafted patch entry could resolve outside the configured patches directory and cause pnpm patch-remove to delete an arbitrary reachable file. This vulnerability is fixed in 10.34.4 and 11.7.0.

AnalysisAI

Arbitrary file deletion in pnpm before 10.34.4 and 11.7.0 allows a malicious project to delete any file reachable by the user when they run 'pnpm patch-remove'. A crafted patch entry escapes the configured patches directory via path traversal (CWE-22), so cloning or installing an attacker-controlled repository and running the patch-remove command destroys files outside the project. No public exploit identified at time of analysis and it is not on CISA KEV; exploitation requires the victim to run the specific command against poisoned configuration.

Technical ContextAI

pnpm is a widely-used Node.js package manager that supports patching dependencies via 'pnpm patch'/'pnpm patch-remove', storing patch files under a configured patches directory (typically ./patches). The flaw is a path traversal (CWE-22): the patch entry name/path is used to locate the file to remove without properly confining it to the patches directory, so sequences such as '../' resolve outside the intended root. When 'pnpm patch-remove' performs its deletion, it therefore operates on an arbitrary reachable filesystem path. The single affected CPE is cpe:2.3:a:pnpm:pnpm, i.e. the pnpm CLI itself rather than any dependency; the root cause is unsanitized, untrusted patch-configuration data controlling a filesystem delete operation.

RemediationAI

Vendor-released patch: upgrade pnpm to 10.34.4 (for the 10.x line) or 11.7.0 (for the 11.x line) as documented in the advisory at https://github.com/pnpm/pnpm/security/advisories/GHSA-72r4-9c5j-mj57; pin the patched version in CI images and developer toolchains. Until upgraded, avoid running 'pnpm patch-remove' on untrusted or externally-sourced projects, and review the patches configuration for any entries containing traversal sequences ('../') or absolute paths before executing patch commands; the trade-off is manual inspection overhead and temporarily forgoing the patch-remove workflow on unvetted repositories. Running package operations on untrusted code in a sandboxed or containerized environment with least-privilege filesystem access further limits blast radius at the cost of workflow friction.