CVE-2026-50015 pnpm: Arbitrary File Write/Delete via Malicious Patch File (Path Traversal)
Attackers can write or delete arbitrary files via malicious patch files during pnpm install, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-50015?
CVE-2026-50015 is a high-severity path traversal vulnerability in pnpm, published on 25 Jun 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm's patch application pipeline (@pnpm/patch-package) performs no path validation on file paths extracted from .patch files. An attacker who contributes a malicious patch file via a pull request can write attacker-controlled content to or delete arbitrary files on the filesystem during pnpm install, as the user running the install. The diff --git header paths containing ../../ sequences traverse out of the package directory, and the traversal is difficult to catch in code review because patch file diff headers are opaque to most reviewers. This vulnerability is fixed in 10.34.0 and 11.4.0.
Weakness: CWE-22
Which versions are affected by CVE-2026-50015?
4 open source packages ship an affected version, including pnpm. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pnpm npm | All versions | 10.34.0 |
pnpm npm | All versions | 10.34.0 |
pnpm npm | From 11.0.0 | 11.4.0 |
pnpm npm | From 11.0.0 | 11.4.0 |
Products include Pnpm Pnpm.
How do I fix CVE-2026-50015?
Upgrade pnpm to a fixed version for your release line: 10.34.0 or 11.4.0.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-50015 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-50015 exists.
Other vulnerabilities in pnpm
- CVE-2026-50016 pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement
- CVE-2026-55698 pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes
- CVE-2025-69264 pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default"
- CVE-2022-26183 Untrusted Search Path in PNPM
- CVE-2026-59195 pnpm: Path traversal in configDependencies env lockfile allows symlink creation outside node_modules/.pnpm-config
Sources
Also known as GHSA-rxhj-4m44-96r4, MINI-vjgq-m5gq-8882, ROOT-APP-NPM-CVE-2026-50015.