🚨 HIGH - pnpm transitive dependency alias path traversal enables symlink hijack (CVE-2026-50016) pnpm is vulnerable when processing transitive dependency aliases from registry package metadata, allowing an attacker to inject path traversal segments that are later used during dependency linking. The root cause is path traversal / improper input validation where untrusted alias strings are treated as filesystem paths. An attacker exploits this by publishing or compromising a registry package with a crafted alias so that a victim running pnpm install (including pnpm install --ignore-scripts) links dependencies into attacker-chosen locations via symlinks, no script execution required. Impact includes arbitrary project file replacement via symlinked paths, dependency hijacking, and potential follow-on code execution when the project is built or run, plus broader supply-chain compromise. 👉 Affected: pnpm < 10.34.0 and 11.0.0–11.3.x | Upgrade to 10.34.0 or 11.4.0
Post summary
The post discloses a path‑traversal flaw in pnpm’s transitive dependency alias handling that enables symlink hijacking, details how the vulnerability can be leveraged, and advises upgrading to patched releases.
