{"action":"Upgrade pnpm to 10.34.4 or later.","affected":[{"fixed":"10.34.4","introduced":"0"},{"fixed":"11.7.0","introduced":"11.0.0"}],"component":"pnpm","cve_ids":["CVE-2026-59194"],"ecosystem":"npm","epss":0.00401,"exploited":false,"fixed_versions":["10.34.4","11.7.0"],"ghsa_id":"GHSA-72r4-9c5j-mj57","id":"tcs_01M5KF8J5YVP1AW10VNMW5QA7E","modified_at":"2026-07-08T08:27:15.664767504Z","published_at":"2026-06-27T00:12:39Z","references":["https://osv.dev/vulnerability/GHSA-72r4-9c5j-mj57","https://github.com/pnpm/pnpm/security/advisories/GHSA-72r4-9c5j-mj57","https://github.com/pnpm/pnpm/commit/612a2e6a7333f2b061f452a21b6e62c1c161747f","https://github.com/pnpm/pnpm","http://github.com/pnpm/pnpm/commit/352ae489f1b14ffdc19d2c6eacb1b06b098c2ddc"],"severity":{"label":"high","score":7.1},"sources":[{"source":"osv","source_id":"GHSA-72r4-9c5j-mj57","url":"https://osv.dev/vulnerability/GHSA-72r4-9c5j-mj57"}],"summary":"pnpm: `patch-remove` could delete project-selected files outside the patches directory"}