MEDIUM

CVE-2026-55180

Pnpm Pnpm 2026-06-25 CVSS v3.1

CVSS

6.5

Description

pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm and pacquet expanded ${ENV_VAR} placeholders from repository-controlled .npmrc and pnpm-workspace.yaml into registry request destinations and registry credentials. A malicious repository could cause dependency resolution to send victim environment secrets to an attacker-selected registry before lifecycle scripts run. This vulnerability is fixed in 10.34.2 and 11.5.3.

Weakness (CWE)

CWE-200 Information Exposure

CWE-201

CWE-522 Insufficiently Protected Credentials

EPSS Score

0.37%

Probability of exploitation in next 30 days

30.5th percentile

References

https://github.com/pnpm/pnpm/security/advisories/GHSA-3qhv-2rgh-x77r Exploit, Vendor Advisory

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE