High [CVE-2026-59194] patch-remove could delete project-selected files outside the patches directory

pnpm is a package manager. Prior to 10.34.4 and 11.7.0, a crafted patch entry could resolve outside the configured patches directory and cause pnpm patch-remove to delete an arbitrary reachable file.

This vulnerability is fixed in 10.34.4 and 11.7.0. A remote attacker could exploit this vulnerability by providing a specially crafted patch entry.

This could lead to data integrity issues or a denial of service. When the `pnpm patch-remove` command processes such an entry, it may resolve paths outside the intended patches directory, allowing the deletion of arbitrary files.

While the primary issue is addressed by validating paths, a local attacker could still exploit a time-of-check/time-of-use race condition to achieve similar effects. Red Hat severity: Important — CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L).

Weakness: CWE-22. Affected Red Hat products: Red Hat Build of Keycloak.

Red Hat lists Red Hat AMQ Broker 7; Red Hat JBoss Enterprise Application Platform 8; Red Hat JBoss Enterprise Application Platform Expansion Pack as not affected. Red Hat does not currently list a fixing RHSA for this CVE.