{"id":"EUVD-2026-87974","revision":"a0f1a5e01feb49a2b0c8ab37bcdb3d8f","records":[{"revision":"a0f1a5e01feb49a2b0c8ab37bcdb3d8f","observedAt":"2026-11-01T01:21:22.159+00:00","statement":{"source":"euvd","id":"EUVD-2026-87974","aliases":["CVE-2026-101043","GHSA-49pq-2gf3-jw76"],"title":"pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand ${VAR} environment-variable placeholders in the httpProxy, httpsProxy, and noProxy settings read from a project's pnpm-workspace.yaml. Because the manifest is repository-c…","description":"pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand ${VAR} environment-variable placeholders in the httpProxy, httpsProxy, and noProxy settings read from a project's pnpm-workspace.yaml. Because the manifest is repository-controlled and the proxy keys were omitted from the request-destination key set that otherwise suppresses placeholder expansion for untrusted manifests (as already done for registry, pnprServer, registries and namedRegistries), an attacker who controls a repository's pnpm-workspace.yaml can cause a victim who clones the repository and runs a pnpm command (e.g. pnpm install) to expand environment secrets such as NPM_TOKEN or GITHUB_TOKEN into a proxy hostname or userinfo and route install traffic — and the corresponding DNS lookups — through an attacker-controlled host. The exfiltration occurs during configuration loading, before any lifecycle script executes. Fixed in pnpm 11.11.0 and 10.34.5.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","score":8.3,"severity":null}],"references":["https://github.com/pnpm/pnpm/security/advisories/GHSA-vx52-2968-3vc6","https://www.vulncheck.com/advisories/pnpm-11.0.0-before-11.11.0-environment-variable-exfiltration-via-proxy-settings"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-87974","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 27, 2026, 5:02:33 PM","dateUpdated":"Sep 30, 2026, 3:47:12 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-87974","identifiers":["EUVD-2026-87974","CVE-2026-101043","GHSA-49pq-2gf3-jw76"]},"retained":false,"historicalAffected":[]}],"coverage":[]}