pnpm 11.0.0 before 11.11.0 Environment Variable Exfiltration via Proxy Settings

Description

pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand ${VAR} environment-variable placeholders in the httpProxy, httpsProxy, and noProxy settings read from a project's pnpm-workspace.yaml. Because the manifest is repository-controlled and the proxy keys were omitted from the request-destination key set that otherwise suppresses placeholder expansion for untrusted manifests (as already done for registry, pnprServer, registries and namedRegistries), an attacker who controls a repository's pnpm-workspace.yaml can cause a victim who clones the repository and runs a pnpm command (e.g. pnpm install) to expand environment secrets such as NPM_TOKEN or GITHUB_TOKEN into a proxy hostname or userinfo and route install traffic — and the corresponding DNS lookups — through an attacker-controlled host. The exfiltration occurs during configuration loading, before any lifecycle script executes. Fixed in pnpm 11.11.0 and 10.34.5.

Scores

EPSS (exploitation in 30 days)

0.29% · top 79% of all CVEs (6 Nov 2026)

CISA SSVC

Exploitation: poc · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.3.

Weakness

• CWE-201: Insertion of Sensitive Information Into Sent Data (opens in a new tab)All about CWE-201 and its CVEs

Affected products

• pnpm · pnpm

  • affected 11.0.0 – < 11.11.0
  • unaffected 11.11.0

• pnpm · pnpm

  • affected 10.7.0 – < 10.34.5
  • unaffected 10.34.5

References (2)

• GitHub Security Advisory (GHSA-vx52-2968-3vc6) (opens in a new tab)vendor-advisoryexploit
• VulnCheck Advisory: pnpm 11.0.0 before 11.11.0 Environment Variable Exfiltration via Proxy Settings (opens in a new tab)third-party-advisory

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2026-101043](https://trackcve.app/badge/CVE-2026-101043.svg)](https://trackcve.app/cve/CVE-2026-101043)

Record last updated 30 Sept 2026, 15:47 UTC.