PT-2026-52515 · Pnpm · Pnpm

Published 2026-06-25 · Updated 2026-06-25 · CVE-2026-50016

NVD

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm allows a transitive dependency alias from registry package metadata to contain path traversal segments. During install, pnpm later uses that alias as a filesystem path when linking dependency nodes. As a result, a registry package can cause pnpm install --ignore-scripts to replace paths in the current project with symlinks to attacker-controlled dependency package directories. This vulnerability is fixed in 10.34.0 and 11.4.0.

Exploit

Fix

Relative Path Traversal

Weakness Enumeration

CWE-23

Related Identifiers

CVE-2026-50016

Affected Products

Pnpm

References · 2

• 🔥 https://github.com/pnpm/pnpm/security/advisories/GHSA-hwx4-2j3j-g496 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-50016 · Security Note