pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement (CVE-2026-50016)

pnpm, a package manager, has a vulnerability (CVE-2026-50016) in versions before 10.34.0 and 11.4.0 where a transitive dependency alias from registry package metadata may contain path traversal segments. During the installation process, pnpm uses this alias as a filesystem path when linking dependency nodes. This can lead to an attacker-controlled registry package causing `pnpm install --ignore-scripts` to replace paths in the current project with symlinks pointing to attacker-controlled dependency package directories. This vulnerability is addressed in pnpm versions 10.34.0 and 11.4.0.

An attacker can exploit this vulnerability to override paths in the victim's project directory with symbolic links to malicious dependency directories. This can lead to arbitrary code execution or modification of project files, impacting confidentiality, integrity, and availability of the affected system. The CVSS score of 8.8 indicates a high severity vulnerability with network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Upgrade pnpm to version 10.34.0 or later, or 11.4.0 or later, where this vulnerability is fixed. Since a patch is available, applying the official fix is the recommended remediation. No additional mitigations are specified.