EUVD-2026-41881Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessPublish repo with crafted patch entry
-
DeliveryVictim clones untrusted project
-
ExploitVictim runs pnpm patch-remove
-
ExecutionTraversal escapes patches directory
-
ImpactArbitrary reachable file deleted
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Path canonicalization, traversal prevention
MITRE ATT&CK
2 techniques across 2 tactics: Discovery, Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires (1) the victim to open/consume an attacker-controlled project whose pnpm patch configuration contains a crafted patch entry with a path-traversal path escaping the configured patches directory, and (2) the victim to actively run 'pnpm patch-remove' on a vulnerable version (pnpm < 10.34.4 or < 11.7.0). Limiting factors: the attack is not self-driving - it needs user interaction (UI:R) in the form of running the specific patch-remove command, so it does not fire during a normal install; impact is limited to files reachable/deletable by the invoking user's privileges, and there is no confidentiality disclosure. It effectively targets developer and CI workflows that process untrusted repositories, not exposed network services. |
| Impact | The signals point to a moderate, interaction-gated risk rather than a mass-exploitation threat. The CVSS 3.1 base of 7.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L) reflects network reach only in the sense that malicious configuration arrives over the network (a repo/package), but the actual trigger is local execution of 'pnpm patch-remove' by the victim (UI:R), and impact is file deletion (I:H, A:L) with no confidentiality loss (C:N). There is no EPSS score, KEV listing, or POC in the provided data, so there is no evidence of active or automated exploitation. The practical risk is confined to developer/CI environments that consume untrusted projects and run patch commands; it is not a remotely-drivable server exploit despite the AV:N metric, so treat the network-vector framing with caution - the description implies the victim must voluntarily run a command against attacker-supplied patch config. |
| Exploit ScenarioDerived | An attacker publishes a repository or package whose pnpm patch configuration includes a crafted patch entry with a traversal path pointing outside the patches directory. A developer clones or installs the project and runs 'pnpm patch-remove' as part of dependency maintenance, at which point pnpm resolves the path outside the intended directory and deletes an arbitrary reachable file such as a source, config, or credential file. No public POC is referenced, and success depends on the victim actively running the vulnerable command. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 06, 2026
Arbitrary file deletion in pnpm before 10.34.4 and 11.7.0 allows a malicious project to delete any file reachable by the user when they run 'pnpm patch-remove'. A crafted patch entry escapes the configured patches directory via path traversal (CWE-22), so cloning or installing an attacker-controlled repository and running the patch-remove command destroys files outside the project. No public exploit identified at time of analysis and it is not on CISA KEV; exploitation requires the victim to run the specific command against poisoned configuration.
RemediationAI
Vendor-released patch: upgrade pnpm to 10.34.4 (for the 10.x line) or 11.7.0 (for the 11.x line) as documented in the advisory at https://github.com/pnpm/pnpm/security/advisories/GHSA-72r4-9c5j-mj57; pin the patched version in CI images and developer toolchains. Until upgraded, avoid running 'pnpm patch-remove' on untrusted or externally-sourced projects, and review the patches configuration for any entries containing traversal sequences ('../') or absolute paths before executing patch commands; the trade-off is manual inspection overhead and temporarily forgoing the patch-remove workflow on unvetted repositories. Running package operations on untrusted code in a sandboxed or containerized environment with least-privilege filesystem access further limits blast radius at the cost of workflow friction.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in npm
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
pnpm is a widely-used Node.js package manager that supports patching dependencies via 'pnpm patch'/'pnpm patch-remove', storing patch files under a configured patches directory (typically ./patches). The flaw is a path traversal (CWE-22): the patch entry name/path is used to locate the file to remove without properly confining it to the patches directory, so sequences such as '../' resolve outside the intended root. When 'pnpm patch-remove' performs its deletion, it therefore operates on an arbitrary reachable filesystem path. The single affected CPE is cpe:2.3:a:pnpm:pnpm, i.e. the pnpm CLI itself rather than any dependency; the root cause is unsanitized, untrusted patch-configuration data controlling a filesystem delete operation.
Know when Pnpm gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
Malicious config is delivered remotely (AV:N) but requires the victim to run patch-remove (UI:R) with no auth (PR:N); arbitrary file deletion gives I:H with partial A:L and no confidentiality (C:N).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
1DescriptionCVE.org
pnpm is a package manager. Prior to 10.34.4 and 11.7.0, a crafted patch entry could resolve outside the configured patches directory and cause pnpm patch-remove to delete an arbitrary reachable file. This vulnerability is fixed in 10.34.4 and 11.7.0.
Executive ViewAI
pnpm, a package manager critical to JavaScript development pipelines, contains an arbitrary file deletion vulnerability that allows malicious repositories to destroy any files accessible to developers when they run 'pnpm patch-remove'. No public exploit identified at time of analysis; exploitation requires developers to execute this command against a poisoned repository. This threatens immediate loss of source code, configurations, and project data across development teams and CI/CD infrastructure.
No vendor-released patch identified at time of analysis. Interim mitigations: disable or restrict 'pnpm patch-remove' functionality in all development and production environments; implement file system monitoring and alerting for unexpected file deletion patterns; enforce strict repository access controls limiting package installations to verified and approved sources; apply principle of least privilege to developer file system permissions; conduct security awareness training on supply chain and repository risks.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Arbitrary code execution in the pnpm package manager (versions 10.0.0 through 10.25) lets a git-hosted dependency run co
pnpm is a package manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentica
Path traversal in pnpm before 10.34.0 and 11.4.0 lets a malicious registry package smuggle '../' segments inside a trans
Arbitrary code execution in the pnpm package manager (versions prior to 10.34.2 and 11.5.3) lets a malicious repository
Arbitrary command execution in pnpm before 10.34.2 and 11.5.3 allows a malicious repository to run attacker-chosen nativ
Supply-chain integrity bypass in pnpm package manager (versions ≤10.26.2, per description; GHSA states <10.26.0) allows
PNPM v6.15.1 and below was discovered to contain an untrusted search path which causes the application to behave in unex
Integrity-check bypass in the pnpm package manager (versions before 10.34.0/10.34.1 and 11.0.0-11.3.x) lets tampered pac
Command injection in pnpm versions 6.25.0 through 10.26.2 allows attackers controlling environment variables to execute
Scoped path traversal in pnpm allows arbitrary filesystem overwrites during package installation, defeating the --ignore
Arbitrary file write and deletion in pnpm package manager (versions prior to 10.34.0 and 11.4.0) lets a malicious contri
Arbitrary command execution in pnpm before 10.34.0 and 11.4.0 allows a malicious lockfile to run code on a developer's m
Exploit-DB