Environment Variable Exfiltration in pnpm by PNPM

CVE-2026-101043

What is CVE-2026-101043?

pnpm versions from 11.0.0 before 11.11.0 and from 10.7.0 before 10.34.5 are susceptible to an environment variable exfiltration vulnerability. This occurs when the httpProxy, httpsProxy, and noProxy settings in the pnpm-workspace.yaml allow for the expansion of ${VAR} placeholders. An attacker controlling a repository can manipulate these settings, enabling them to exfiltrate sensitive environment variables like NPM_TOKEN and GITHUB_TOKEN when a victim runs commands such as pnpm install. The vulnerability primarily arises during configuration loading, allowing the attacker to intercept traffic through a malicious proxy, leading to potential exposure of critical secrets. This issue has been addressed in versions 11.11.0 and 10.34.5.

References