Path Traversal Vulnerability in pnpm Package Manager

CVE-2026-50016

What is CVE-2026-50016?

pnpm, a popular package manager, is susceptible to a path traversal vulnerability that allows transitive dependency aliases from registry package metadata to include path traversal segments. This flaw can lead to potential exploits during installation when pnpm install --ignore-scripts is executed, enabling malicious registry packages to replace legitimate paths in the current project with symlinks pointing to directories controlled by the attacker. The issue has been resolved in versions 10.34.0 and 11.4.0.

References