CVE-2026-50016: pnpm Path Traversal Vulnerability Allows Project Path Override via Symlink Replacement
Summary
CVE-2026-50016: pnpm: Transitive dependency alias path traversal allows project path override via symlink replacement. Affects pnpm across 2 version ranges.
< 10.34.0
>= 11.0.0, < 11.4.0
Fixed in 10.34.0 or 11.4.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pnpm is a fast, disk space-efficient package manager for JavaScript and Node.js applications. It utilizes a unique approach to dependency management, allowing for efficient installations and reduced duplication of packages. However, pnpm has a vulnerability that allows transitive dependency alias path traversal, which can lead to serious security risks.
Vulnerability Detail
The vulnerability arises from pnpm's handling of transitive dependency aliases, which can contain path traversal segments. During installation, these aliases are treated as filesystem paths, allowing a malicious package to create symlinks that point to attacker-controlled directories. This can lead to the replacement of critical project files or directories, such as Git hooks or build outputs, with symlinks to malicious code. Users often run pnpm install --ignore-scripts expecting that no untrusted code will execute, but this vulnerability bypasses that expectation, potentially leading to unauthorized code execution when subsequent commands are run.
How To Fix
Latest published version: 12.15.0 as of 23 Oct 2026
npm install pnpm@12.15.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 10.34.010.34.0npm install pnpm@10.34.0 -
>= 11.0.0, < 11.4.011.4.0npm install pnpm@11.4.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid using transitive dependencies from untrusted sources. Additionally, consider using the --no-symlink option during installation to prevent symlink creation, although this may affect functionality.
Conclusion
The pnpm vulnerability CVE-2026-50016 poses a significant risk by allowing path traversal through transitive dependency aliases. Users are advised to update to the latest patched versions to protect their projects from potential exploitation. Utilizing tools like Vulert can help in monitoring and identifying vulnerabilities in real-time.
See every vulnerability recorded for pnpm →
FAQ
CVE-2026-50016 is a vulnerability in pnpm that allows path traversal through transitive dependency aliases, enabling attackers to replace project paths with symlinks to malicious directories.
This vulnerability can lead to unauthorized code execution in your project by replacing critical files or directories with symlinks to attacker-controlled code.
If you are using an affected version of pnpm, you should update to version 10.34.0 or 11.4.0 to mitigate the vulnerability.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities using just your package-lock.json file. You can check your application using the Vulert playground at Vulert Scanner.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for pnpm.
