CVE-2026-50016
High
Description
pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm allows a transitive dependency alias from registry package metadata to contain path traversal segments. During install, pnpm later uses that alias as a filesystem path when linking dependency nodes. As a result, a registry package can cause `pnpm install --ignore-scripts` to replace paths in the current project with symlinks to attacker-controlled dependency package directories. This vulnerability is fixed in 10.34.0 and 11.4.0.
SeverityHigh
CVSS8.8
Exploit probability—
ProductPnpm
PublishedJun 25, 2026
First seenJun 25, 2026
Weakness typeCWE-23CWE-23
How to fix
Update
- pnpm pnpm10.34.0, 11.4.0 or later
- pnpm10.34.0, 11.4.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pnpm pnpm | v < 10.34.0, 11.0.0 ≤ v < 11.4.0 | 10.34.0, 11.4.0 |
| pnpmnpm | v < 10.34.0, 11.0.0 ≤ v < 11.4.0 | 10.34.0, 11.4.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.