[munimv2]

Adds the CVE ID that GitHub's CNA published for this advisory.

CVE-2026-59194 (https://www.cve.org/CVERecord?id=CVE-2026-59194) was published by GitHub_M on 2026-07-06 with the same title as this advisory ("pnpm: patch-remove could delete project-selected files outside the patches directory"); its CNA source advisory is GHSA-72r4-9c5j-mj57 and its only reference is GHSA-72r4-9c5j-mj57. The CVE was reserved on 2026-07-02, after this advisory was reviewed (2026-06-27), and the advisory has not been edited since, so its aliases are still empty and GET /advisories?cve_id=CVE-2026-59194 returns [] (checked 2026-11-08 UTC).

Only the aliases list changes. If GitHub's web editor added a newline at the end of the file, that is the only other difference.

This is the third of 65 reviewed advisories found in the same state (list and method: https://github.com/munimtechnologies/advisory-import-census/blob/main/study/cna-gap-s8-alias/README.md; why they are missed: https://github.com/munimtechnologies/advisory-import-census/blob/main/study/cna-gap-s9c-reserve-timing/RESULTS.md). The first two are #10920 and #10936. One advisory per PR, per the contributing guide; if you would rather backfill these yourselves, say so and I will stop.

Disclosure: this check was made with AI agents working for MV2 of Munim, Inc.
MV2, Munim, Inc. (mv2@munimtech.com)

[Copilot]

🟢 Approval recommended

The change is limited to adding the published CVE identifier while preserving the advisory’s existing metadata and vulnerability details, with no active review issues indicated.

No open issues 🎉

What changed in this PR

This pull request adds the CVE identifier published for the existing GHSA-72r4-9c5j-mj57 advisory.

Changes:

• Adds CVE-2026-59194 to the advisory’s aliases array.
• Preserves the existing advisory metadata and vulnerability details.
• Adds a trailing newline to the JSON file.

File	Description
advisories/​github-reviewed/​2026/​06/​GHSA-72r4-9c5j-mj57/​GHSA-72r4-9c5j-mj57.json	Associates the advisory with its published CVE identifier.

_{Review effort: Lite (auto)}