CVE-2026-50015— pnpm: Arbitrary File Write/Delete via Malicious Patch File (Path Traversal)
Possible ATT&CK Techniques 3AI
T1496 · Resource Hijacking T1059 · Command and Scripting Interpreter T1610 · Deploy ContainerGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-50015
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
pnpm: Arbitrary File Write/Delete via Malicious Patch File (Path Traversal)
Source: NVD (National Vulnerability Database)
Vulnerability Description
pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm's patch application pipeline (@pnpm/patch-package) performs no path validation on file paths extracted from .patch files. An attacker who contributes a malicious patch file via a pull request can write attacker-controlled content to or delete arbitrary files on the filesystem during pnpm install, as the user running the install. The diff --git header paths containing ../../ sequences traverse out of the package directory, and the traversal is difficult to catch in code review because patch file diff headers are opaque to most reviewers. This vulnerability is fixed in 10.34.0 and 11.4.0.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: NVD (National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-50015
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-50015
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-50015 (1)
Same Patch Batch · pnpm · 2026-06-25 · 13 CVEs total
| CVE-2026-50016 | 8.8 HIGH | pnpm: Transitive dependency alias path traversal allows project path override via symlink |
| CVE-2026-55698 | 8.8 HIGH | pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfi |
| CVE-2026-55487 | 7.5 HIGH | pnpm: manifest identity spoof satisfies allowBuilds and runs attacker lifecycle |
| CVE-2026-55697 | 7.5 HIGH | pnpm: Repository-controlled configDependencies can select a pacquet native install engine |
| CVE-2026-55700 | 7.1 HIGH | pnpm: stage download writes outside destination via manifest version traversal |
| CVE-2026-50021 | 6.8 MEDIUM | pnpm: Integrity Check Bypass via Missing Lockfile Integrity Field |
| CVE-2026-50573 | 6.8 MEDIUM | pnpm: Unsafe default behavior breaks integrity check |
| CVE-2026-55180 | 6.5 MEDIUM | pnpm: Repository config can expand victim environment secrets into registry requests befor |
| CVE-2026-55699 | 6.5 MEDIUM | pnpm: reserved bin name deletes PNPM_HOME during global remove |
| CVE-2026-50014 | 6.4 MEDIUM | pnpm: Git Fetch Argument Injection via Lockfile resolution.commit |
| CVE-2026-48995 | pnpm: Tarball hash of GitHub git dependencies is not stored in lockfile | |
| CVE-2026-50017 | pnpm binds unscoped user-level npm auth credentials to a repository-selected registry |
IV. Related Vulnerabilities
Same product: pnpm
- CVE-2026-55180
pnpm: Repository config can expand victim environment secret - CVE-2026-48995
pnpm: Tarball hash of GitHub git dependencies is not stored - CVE-2026-50017
pnpm binds unscoped user-level npm auth credentials to a rep - CVE-2026-50016
pnpm: Transitive dependency alias path traversal allows proj - CVE-2026-50014
pnpm: Git Fetch Argument Injection via Lockfile resolution.c
Same vendor: pnpm
- CVE-2026-55180
pnpm: Repository config can expand victim environment secret - CVE-2026-48995
pnpm: Tarball hash of GitHub git dependencies is not stored - CVE-2026-50017
pnpm binds unscoped user-level npm auth credentials to a rep - CVE-2026-50016
pnpm: Transitive dependency alias path traversal allows proj - CVE-2026-50014
pnpm: Git Fetch Argument Injection via Lockfile resolution.c
V. Comments for CVE-2026-50015
No comments yet