High [CVE-2026-50016] Arbitrary code execution due to path traversal in dependency aliases

pnpm is a package manager. During install, pnpm later uses that alias as a filesystem path when linking dependency nodes.

This vulnerability is fixed in 10.34.0 and 11.4.0. This vulnerability allows a malicious registry package to include specially crafted dependency aliases that contain path traversal segments.

During the installation process, pnpm incorrectly processes these aliases, which can lead to the replacement of legitimate project paths with symbolic links (symlinks) pointing to directories controlled by an attacker.

This could enable an attacker to execute arbitrary code or manipulate project files, severely impacting the integrity and security of the project. During installation, even with `--ignore-scripts`, specially crafted dependency aliases can lead to path traversal, replacing legitimate project files with symlinks to attacker-controlled directories.

This bypasses expected security measures and can compromise the integrity of a project when subsequent commands are executed. Red Hat severity: Important — CVSS 8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H).

Weakness: CWE-22. Affected Red Hat products: Red Hat Build of Keycloak.

Red Hat lists Red Hat AMQ Broker 7; Red Hat JBoss Enterprise Application Platform 8; Red Hat JBoss Enterprise Application Platform Expansion Pack as not affected. Red Hat does not currently list a fixing RHSA for this CVE.