Package Manager Vulnerability in pnpm by pnpm

CVE-2026-50017

What is CVE-2026-50017?

Prior to versions 10.34.0 and 11.4.0, pnpm, a popular package manager, was vulnerable to an issue that allowed the exposure of user-level unscoped npm authentication credentials. This occurred when a repository-local .npmrc file directed pnpm to use a different registry without providing a token-bearing authentication line. When users had an unscoped _authToken set as their npm configuration's default, pnpm mistakenly included these sensitive credentials in requests to the specified registry, leading to potential unauthorized access. The issue has been addressed in subsequent updates.

References