High [CVE-2026-50015] Arbitrary file write/delete due to lack of path validation in patch files

pnpm is a package manager. An attacker who contributes a malicious patch file via a pull request can write attacker-controlled content to or delete arbitrary files on the filesystem during pnpm install, as the user running the install.

The diff --git header paths containing../../ sequences traverse out of the package directory, and the traversal is difficult to catch in code review because patch file diff headers are opaque to most reviewers. This vulnerability is fixed in 10.34.0 and 11.4.0.

A flaw was found in pnpm. During the pnpm install process, the patch application pipeline fails to validate file paths extracted from these patch files.

This allows the attacker to write or delete arbitrary files on the filesystem, potentially leading to arbitrary code execution or privilege escalation on the system where pnpm install is executed.

This is due to insufficient path validation within the patch application pipeline, allowing directory traversal and potentially leading to arbitrary code execution or privilege escalation on the system where the installation is performed. Red Hat severity: Important — CVSS 7.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H).

Weakness: CWE-22. Red Hat lists Red Hat AMQ Broker 7; Red Hat Build of Keycloak; Red Hat JBoss Enterprise Application Platform 8; Red Hat JBoss Enterprise Application Platform Expansion Pack as not affected.