CVE-2026-50016

[CVE catalog]

Severity

High · CVSS 8.8

Published

Jun 25, 2026, 4:53:16 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.53% · Oct 25, 2026

A flaw was found in pnpm, a package manager. This vulnerability allows a malicious registry package to include specially crafted dependency aliases that contain path traversal segments. During the installation process, pnpm incorrectly processes these aliases, which can lead to the replacement of legitimate project paths with symbolic links (symlinks) pointing to directories controlled by an attacker. This could enable an attacker to execute arbitrary code or manipulate project files, severely impacting the integrity and security of the project. pnpm: pnpm: Arbitrary code execution due to path traversal in dependency aliases This Important flaw in pnpm, a JavaScript package manager, allows an attacker to achieve arbitrary code execution by publishing a malicious package to a registry. During installation, even with `--ignore-scripts`, specially crafted dependency aliases can lead to path traversal, replacing legitimate project files with symlinks to attacker-controlled directories. This bypasses expected security measures and can compromise the integrity of a project when subsequent commands are executed. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.