pnpm: Arbitrary File Write/Delete via Malicious Patch File (Path Traversal) (CVE-2026-50015)

pnpm's patch application pipeline (@pnpm/patch-package) before versions 10.34.0 and 11.4.0 does not validate file paths extracted from .patch files. An attacker contributing a malicious patch file containing diff --git header paths with '../../' sequences can cause arbitrary file write or deletion on the filesystem during 'pnpm install' executed by the user. This path traversal vulnerability allows modification of files outside the intended package directory. The issue is resolved in pnpm versions 10.34.0 and 11.4.0.

An attacker who can contribute a malicious patch file (e.g., via a pull request) can exploit this vulnerability to write or delete arbitrary files on the filesystem with the privileges of the user running 'pnpm install'. This can lead to integrity and availability impacts on the affected system. There is no indication of confidentiality impact. No known exploits in the wild have been reported.

Upgrade pnpm to version 10.34.0 or later, or 11.4.0 or later, where this vulnerability is fixed. Users should avoid applying untrusted patch files until patched versions are deployed.