Is there a patch available for EUVD-2026-39495?

Yes, a patch is available for EUVD-2026-39495. Update the affected software to the latest version immediately.

pnpm EUVD-2026-39495

Q: What is the CVSS score of EUVD-2026-39495?

EUVD-2026-39495 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-50017 MEDIUM

Information Exposure (CWE-200)

2026-06-25 GitHub_M

GHSA-cjhr-43r9-cfmw

Information Disclosure Node.js Red Hat Pnpm

6.9

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Attacker needs no privileges on the victim system (PR:N, AV:N), but developer must invoke pnpm in a malicious repository (UI:R); only the npm token is exposed, so C:H with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Patch available

Jun 25, 2026 - 19:17 EUVD

Analysis Generated

Jun 25, 2026 - 18:23 vuln.today

DescriptionCVE.org

pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm can send user-level unscoped npm authentication credentials to a registry chosen by a repository-local .npmrc file. In the reproduced case, the user's npm config contains a default registry and an unscoped _authToken. The repository does not provide a token-bearing auth line. It only sets registry= to a different registry URL. During normal pnpm metadata/install workflows, pnpm binds the user-origin unscoped credential to the repository-selected registry and sends it as an Authorization header. This vulnerability is fixed in 10.34.0 and 11.4.0.

AnalysisAI

Credential leakage in pnpm package manager versions prior to 10.34.0 and 11.4.0 exposes a developer's unscoped npm authentication token to attacker-controlled registries. When a project-level .npmrc overrides the registry URL without supplying its own auth token, pnpm incorrectly inherits and forwards the user's globally-configured unscoped _authToken to that foreign registry as an Authorization header. No public exploit has been identified at time of analysis, though the real-world impact is severe - a captured npm token can enable supply chain attacks via malicious package publishing.

Technical ContextAI

pnpm (cpe:2.3:a:pnpm:pnpm:*:*:*:*:*:*:*:*) is a Node.js package manager that resolves registry configuration by merging user-level (~/.npmrc) and project-level (.npmrc) configuration files. The CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) root cause is a credential-scoping defect in pnpm's auth-binding logic: when a project .npmrc sets registry= to a new URL but provides no corresponding auth token for that registry, pnpm incorrectly propagates the user's unscoped _authToken - which is intended only for the user's default registry - to the overridden registry endpoint. This violates the principle that credentials should be bound to their origin registry scope. The vulnerability surfaces during normal metadata fetch and install workflows, meaning routine pnpm operations trigger the credential leak without any atypical user action beyond running pnpm in the affected repository.

RemediationAI

Upgrade pnpm to version 10.34.0 or later (v10 branch) or 11.4.0 or later (v11 branch), as confirmed by vendor advisory GHSA-cjhr-43r9-cfmw at https://github.com/pnpm/pnpm/security/advisories/GHSA-cjhr-43r9-cfmw. If an immediate upgrade is not feasible, the most effective compensating control is to replace unscoped _authToken entries in ~/.npmrc with registry-scoped tokens in the form //registry.npmjs.org/:_authToken=TOKEN - scoped credentials are tied to a specific registry hostname and are significantly less likely to be forwarded to a foreign endpoint; the trade-off is a slightly more verbose per-registry configuration. Additionally, developers should audit project-level .npmrc files for unexpected registry= overrides before running pnpm in unfamiliar or third-party repositories. Organizations with CI/CD pipelines should ensure pipeline npm tokens are also scoped rather than unscoped. No workaround fully eliminates risk without either upgrading or removing unscoped tokens.