CVE-2026-101043

Name of the Vulnerable Software and Affected Versions pnpm versions 11.0.0 through 11.10.f pnpm versions 10.7.0 through 10.34.4

Description The software expands ${VAR} environment-variable placeholders in the httpProxy, httpsProxy, and noProxy settings read from a project's pnpm-workspace.yaml file. Since this manifest is repository-controlled, an attacker who controls the pnpm-workspace.yaml can force a user who clones the repository and executes a pnpm command to expand environment secrets, such as NPM TOKEN or GITHUB TOKEN, into a proxy hostname or userinfo. This allows the attacker to route installation traffic and DNS lookups through a host under their control. The exfiltration happens during configuration loading, before any lifecycle script is executed.

Recommendations Update pnpm to version 11.11.0. Update pnpm to version 10.34.5.