EUVD-2026-39498
GHSA-3qhv-2rgh-x77r
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
AV:N as the malicious repo is network-delivered; PR:N since attacker owns the repo not the victim system; UI:R for required clone-and-run; C:H for high-value secret exfiltration; no integrity or availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm and pacquet expanded ${ENV_VAR} placeholders from repository-controlled .npmrc and pnpm-workspace.yaml into registry request destinations and registry credentials. A malicious repository could cause dependency resolution to send victim environment secrets to an attacker-selected registry before lifecycle scripts run. This vulnerability is fixed in 10.34.2 and 11.5.3.
AnalysisAI
Information disclosure in pnpm prior to 10.34.2 and 11.5.3 allows a malicious repository to exfiltrate victim environment secrets by expanding ${ENV_VAR} placeholders in .npmrc and pnpm-workspace.yaml into registry request destinations before lifecycle scripts run. Public proof-of-concept exploit exists, though no active exploitation has been confirmed.
Arbitrary code execution in the pnpm package manager (versions 10.0.0 through 10.25) lets a git-hosted dependency run co
pnpm is a package manager. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentica
Path traversal in pnpm before 10.34.0 and 11.4.0 lets a malicious registry package smuggle '../' segments inside a trans
Arbitrary code execution in the pnpm package manager (versions prior to 10.34.2 and 11.5.3) lets a malicious repository
Arbitrary command execution in pnpm before 10.34.2 and 11.5.3 allows a malicious repository to run attacker-chosen nativ
Supply-chain integrity bypass in pnpm package manager (versions ≤10.26.2, per description; GHSA states <10.26.0) allows
PNPM v6.15.1 and below was discovered to contain an untrusted search path which causes the application to behave in unex
Integrity-check bypass in the pnpm package manager (versions before 10.34.0/10.34.1 and 11.0.0-11.3.x) lets tampered pac
Command injection in pnpm versions 6.25.0 through 10.26.2 allows attackers controlling environment variables to execute
Scoped path traversal in pnpm allows arbitrary filesystem overwrites during package installation, defeating the --ignore
Arbitrary file write and deletion in pnpm package manager (versions prior to 10.34.0 and 11.4.0) lets a malicious contri
Arbitrary command execution in pnpm before 10.34.0 and 11.4.0 allows a malicious lockfile to run code on a developer's m
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today