CVEvulnerability

CVE-2026-55180

6.5 MEDIUM Published 2026-06-25 Modified 2026-06-29 Official page ↗
Status
Analyzed
Published
2026-06-25
Last modified
2026-06-29
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Weaknesses
CWE-200, CWE-201, CWE-522

Description

pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm and pacquet expanded ${ENV_VAR} placeholders from repository-controlled .npmrc and pnpm-workspace.yaml into registry request destinations and registry credentials. A malicious repository could cause dependency resolution to send victim environment secrets to an attacker-selected registry before lifecycle scripts run. This vulnerability is fixed in 10.34.2 and 11.5.3.

Affected configurations

• pnpm pnpm (< 10.34.2) • pnpm pnpm (>= 11.0.0 < 11.5.3)

Related

Weakness · CWE (3)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-201 Insertion of Sensitive Information Into Sent Data weakness
  • CWE-522 Insufficiently Protected Credentials weakness

References