CVE-2026-50016 Details
Description
pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm allows a transitive dependency alias from registry package metadata to contain path traversal segments. During install, pnpm later uses that alias as a filesystem path when linking dependency nodes. As a result, a registry package can cause `pnpm install --ignore-scripts` to replace paths in the current project with symlinks to attacker-controlled dependency package directories. This vulnerability is fixed in 10.34.0 and 11.4.0.
A path traversal vulnerability has been identified in pnpm, a package manager, affecting versions prior to 10.34.0 and 11.0.0 through 11.4.0. The issue arises because pnpm allows transitive dependency aliases in registry package metadata to include path traversal segments. During installation, pnpm uses these aliases as filesystem paths for linking dependency nodes. This vulnerability enables a registry package to manipulate project paths, replacing them with symlinks to directories of attacker-controlled dependency packages. The issue can be exploited by installing a malicious package that takes advantage of the path traversal capability to overwrite project files or directories with links to harmful payloads.
Users can upgrade to pnpm versions 10.34.0 or 11.4.0 and later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pnpm/pnpm/security/advisories/GHSA-hwx4-2j3j-g496 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/pnpm/pnpm/security/advisories/GHSA-hwx4-2j3j-g496 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-23 | Relative Path Traversal | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| pnpm pnpm | < 10.34.0 >= 11.0.0, < 11.4.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 29, 2026 | Initial Analysis | [email protected] |
| Jun 26, 2026 | CVE Modified | CISA-ADP |
| Jun 25, 2026 | CVE Modified | CISA-ADP |
| Jun 25, 2026 | New CVE Received | [email protected] |