HIGHnpm →
pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml
pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml
Affected packages
- pnpm
Exploit signal
- Known exploited (CISA KEV)
- No
- EPSS score
- —
- EPSS percentile
- —
EPSS is the probability a CVE is exploited in the wild; percentile is its rank among all CVEs.
Sources
- https://github.com/pnpm/pnpm/security/advisories/GHSA-vx52-2968-3vc6
- https://github.com/pnpm/pnpm/pull/12871
- https://github.com/pnpm/pnpm/pull/12898
- https://github.com/pnpm/pnpm/commit/36928beae9afb64a2a6a1221df54e66d361320c8
- https://github.com/pnpm/pnpm/commit/5a4daec4bd5f0170b18ae053aff093eea56368ba
- https://github.com/orgs/pnpm/discussions/13598
- https://github.com/pnpm/pnpm
- https://github.com/pnpm/pnpm/releases/tag/v10.34.5
- https://github.com/pnpm/pnpm/releases/tag/v11.11.0
Structured record: https://osv.dev/vulnerability/GHSA-vx52-2968-3vc6
Recommended response stack
Snyk — Scan your dependencies in CI and fix this vulnerability.→Socket — Detect malicious and compromised packages before they ship.→
Some links are affiliate links — HackTribune may earn a commission at no extra cost to you.
Get incidents like this as alerts for your stack.
Join the beta