Path Traversal in pnpm transitive dependency aliases leading to symlink replacement

CVE-2026-50016 is a high-severity path traversal vulnerability in pnpm, the Node.js package manager. In vulnerable versions prior to 10.34.0 and 11.4.0, pnpm permits a transitive dependency alias derived from registry package metadata to contain path traversal segments. During dependency installation and linking, pnpm subsequently uses that alias as a filesystem path when linking dependency nodes. Because the alias is not safely constrained to the intended project directory structure, a malicious package published to a registry can cause pnpm install --ignore-scripts to replace paths inside the current project with symlinks pointing to attacker-controlled dependency package directories. The issue is notable because exploitation does not rely on lifecycle script execution; instead it abuses filesystem path handling during install/link operations.