CVE-2026-50016: pnpm Path Traversal Vulnerability in Dependency Alias Handling

Technical summary

The vulnerability stems from insufficient path sanitization when pnpm processes transitive dependency aliases from registry package metadata. During the dependency resolution and linking phase, pnpm constructs filesystem paths directly from alias values without validating against path traversal patterns. An attacker can embed segments like '../../../' within a package's dependency alias declaration, causing pnpm to resolve these paths outside the intended node_modules directory structure. When symlinks are created during the install process, they become anchored to attacker-controlled package directories rather than legitimate dependency locations. The issue is classified as CWE-23 (Relative Path Traversal), and the vulnerability persists regardless of the --ignore-scripts flag, meaning users cannot mitigate it through script execution controls alone.

Business impact

This vulnerability poses significant supply chain risk for development teams. An attacker can compromise a project's source tree by replacing configuration files, build scripts, or source code with symlinks to attacker-controlled content. Teams relying on pnpm for dependency management face potential code injection, intellectual property theft (via symlinks to monitored directories), and disruption of build pipelines. The attack requires no user interaction beyond running a standard installation command, and it affects both direct and transitive dependencies, expanding the attack surface. Organizations with automated CI/CD pipelines running `pnpm install` without current versions are particularly vulnerable to silent, undetected compromise.

Affected systems

pnpm versions prior to 10.34.0 (for the 10.x line) and prior to 11.4.0 (for the 11.x line) are affected. Any development environment or CI/CD system using these versions to install Node.js dependencies is at risk. The attack vector is network-based and requires the attacker to control or compromise a package on a registry accessible to the target environment. Both npm registry and private/internal registries are potential vectors if they allow untrusted or compromised packages.

Exploitability

This vulnerability has a CVSS 3.1 score of 8.8 (HIGH) with a network-based attack vector, low complexity, no required privileges, and user interaction limited to running a standard install command. While the attack requires the attacker to publish or compromise a package on a registry and for a target to install that package (directly or transitively), the barrier to exploitation is low. A malicious package in a popular transitive dependency chain could silently compromise many projects. No CISA KEV listing exists yet, and no public exploit code has been verified at the time of this advisory, but the straightforward nature of path traversal attacks suggests rapid weaponization is probable once awareness spreads.

Remediation

Upgrade pnpm to version 10.34.0 or later if using the 10.x branch, or to version 11.4.0 or later if using the 11.x branch. These versions include proper path sanitization to reject alias values containing traversal sequences. Perform the upgrade in controlled environments and re-run `pnpm install` to regenerate lock files and ensure no malicious symlinks from previous runs persist. For environments unable to upgrade immediately, audit your pnpm-lock.yaml file for suspicious alias entries containing '../' or '.\' patterns, and manually inspect the node_modules directory for unexpected symlinks pointing outside expected locations.

Patch guidance

Verify the version of pnpm currently in use via `pnpm --version`. Update using your standard Node.js tooling (e.g., `npm install -g pnpm@latest` or via package managers like brew, apt, or choco depending on your platform). After upgrading, clear your node_modules directory and pnpm-lock.yaml file, then run `pnpm install` fresh. Test your build pipeline in a non-production environment first to confirm compatibility. If you use pnpm via CI/CD containers, update your base images and rebuild them. Document the upgrade in your change management system, particularly if pnpm version pinning is enforced across teams.

Detection guidance

Check your current pnpm version against the patched versions (10.34.0+, 11.4.0+). Review pnpm-lock.yaml files for suspicious alias entries containing path traversal sequences like '../', '..\', or similar patterns. Scan node_modules directories for symlinks using commands like `find node_modules -type l` and manually verify that symlinks target expected locations within node_modules or globally installed packages. Implement registry integrity monitoring if using private registries. Monitor for unexpected file modifications in your project root and source directories, especially if your CI/CD logs show package installation steps. Use Software Composition Analysis (SCA) tools configured to flag known vulnerable pnpm versions.

Why prioritize this

This vulnerability merits immediate remediation because it affects supply chain integrity with HIGH severity, has a low barrier to exploitation once weaponized, and strikes at a fundamental trust assumption in the package installation process. The attack can silently compromise projects without triggering visible errors, making it a particularly insidious supply chain risk. Organizations with automated CI/CD pipelines are at elevated risk and should prioritize patching to prevent persistent compromise of build artifacts and deployed code.

Risk score, explained

The CVSS 3.1 score of 8.8 reflects the high confidentiality, integrity, and availability impact (an attacker can read, modify, or delete project files via symlink replacement), combined with network-based attack delivery and low complexity. The user interaction requirement (running pnpm install) is a minor limiting factor but not a substantial barrier in practical development workflows. The lack of current CISA KEV listing does not diminish the severity; this represents a known, exploitable vulnerability in widely-used software.

Frequently asked questions