{"action":"Upgrade pnpm to 10.34.5 or later.","affected":[{"fixed":"11.11.0","introduced":"11.0.0"},{"fixed":"10.34.5","introduced":"10.7.0"}],"component":"pnpm","cve_ids":["CVE-2026-101043"],"ecosystem":"npm","epss":0.00225,"exploited":false,"fixed_versions":["11.11.0","10.34.5"],"ghsa_id":"GHSA-vx52-2968-3vc6","id":"tcs_01M5KGD7DH6K5G61VPF2Y9WCZY","modified_at":"2026-09-28T03:55:58.182153770Z","published_at":"2026-09-01T19:22:42Z","references":["https://osv.dev/vulnerability/GHSA-vx52-2968-3vc6","https://github.com/pnpm/pnpm/security/advisories/GHSA-vx52-2968-3vc6","https://github.com/pnpm/pnpm/pull/12871","https://github.com/pnpm/pnpm/pull/12898","https://github.com/pnpm/pnpm/commit/36928beae9afb64a2a6a1221df54e66d361320c8","https://github.com/pnpm/pnpm/commit/5a4daec4bd5f0170b18ae053aff093eea56368ba","https://github.com/orgs/pnpm/discussions/13598","https://github.com/pnpm/pnpm","https://github.com/pnpm/pnpm/releases/tag/v10.34.5","https://github.com/pnpm/pnpm/releases/tag/v11.11.0"],"severity":{"label":"high","score":7.4},"sources":[{"source":"osv","source_id":"GHSA-vx52-2968-3vc6","url":"https://osv.dev/vulnerability/GHSA-vx52-2968-3vc6"}],"summary":"pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml"}