CVE-2026-59194
1 advisory.
npm/pnpm CVE-2026-59194: high 7.1
pnpm: `patch-remove` could delete project-selected files outside the patches directory
Action: Upgrade pnpm to 10.34.4 or later.
npm i pnpm@10.34.4npm i pnpm@11.7.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 10.34.4 | - |
| 11.0.0 | 11.7.0 | - |
Fixed versions
| 10.34.4 | 11.7.0 |
Sources
- osv: GHSA-72r4-9c5j-mj57
- https://github.com/pnpm/pnpm/security/advisories/GHSA-72r4-9c5j-mj57
- https://github.com/pnpm/pnpm/commit/612a2e6a7333f2b061f452a21b6e62c1c161747f
- https://github.com/pnpm/pnpm
- http://github.com/pnpm/pnpm/commit/352ae489f1b14ffdc19d2c6eacb1b06b098c2ddc
CVE-2026-59194 · published · modified · JSON