Path Traversal Vulnerability in pnpm Package Manager

CVE-2026-50015

What is CVE-2026-50015?

The pnpm package manager has a vulnerability in its patch application pipeline that lacks path validation when applying .patch files. This oversight allows an attacker to contribute a malicious patch file through a pull request, potentially enabling them to write or delete arbitrary files on the filesystem during installation. This is particularly concerning as the vulnerability exploits the diff --git header paths that contain ../../ sequences, allowing the traversal to escape the package directory. Such traversal can be easily overlooked during code reviews, as the diff headers are often opaque and not closely monitored, presenting a serious security risk.

References