CVE-2026-101043
1 advisory.
npm/pnpm CVE-2026-101043: high 7.4
pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml
Action: Upgrade pnpm to 10.34.5 or later.
npm i pnpm@11.11.0npm i pnpm@10.34.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 11.0.0 | 11.11.0 | - |
| 10.7.0 | 10.34.5 | - |
Fixed versions
| 11.11.0 | 10.34.5 |
Sources
- osv: GHSA-vx52-2968-3vc6
- https://github.com/pnpm/pnpm/security/advisories/GHSA-vx52-2968-3vc6
- https://github.com/pnpm/pnpm/pull/12871
- https://github.com/pnpm/pnpm/pull/12898
- https://github.com/pnpm/pnpm/commit/36928beae9afb64a2a6a1221df54e66d361320c8
- https://github.com/pnpm/pnpm/commit/5a4daec4bd5f0170b18ae053aff093eea56368ba
- https://github.com/orgs/pnpm/discussions/13598
- https://github.com/pnpm/pnpm
- https://github.com/pnpm/pnpm/releases/tag/v10.34.5
- https://github.com/pnpm/pnpm/releases/tag/v11.11.0
CVE-2026-101043 · published · modified · JSON