CVE-2026-55180: pnpm Environment Variable Leakage in .npmrc Configuration

Technical summary

The vulnerability stems from insufficient isolation of repository-controlled configuration files. pnpm's environment variable interpolation logic processes ${ENV_VAR} syntax in .npmrc and pnpm-workspace.yaml without distinguishing between user-controlled and repository-controlled contexts. When resolving dependencies, pnpm constructs registry URLs and credential headers using these interpolated values. An attacker can craft a malicious repository containing a .npmrc file with patterns like registry=${PRIVATE_REGISTRY_TOKEN}, causing pnpm to inject local environment secrets into HTTP requests to attacker infrastructure. The vulnerability is classified under information disclosure (CWE-200), exposure of sensitive information through log files (CWE-201), and insufficient protection of credentials (CWE-522). No authentication bypass or remote code execution occurs; the issue is pure credential exfiltration prior to lifecycle script execution.

Business impact

This vulnerability directly threatens organizations where developers routinely work with open-source or third-party repositories. Exposed credentials—API keys, registry tokens, private NPM tokens, cloud provider secrets—can enable attackers to compromise downstream supply chains, inject malicious packages, or escalate access to internal systems. For teams using environment-based secret injection (best practice for CI/CD), a single compromised repository can leak secrets that unlock multiple downstream systems. Organizations managing large dependency graphs face compounded risk as more malicious repositories increase the chance of intersection with active development workflows.

Affected systems

pnpm versions prior to 10.34.2 (9.x and early 10.x releases) and prior to 11.5.3 (11.0.0 through 11.5.2) are affected. The vulnerability also applies to pacquet, a Rust-based implementation that shares similar environment variable expansion logic. Node.js projects using these package managers on developer machines, CI/CD runners, or container build environments are vulnerable if they checkout untrusted repositories or pull from sources without strict code review. Tools and workflows relying on environment variable-based secret management (GitHub Actions, GitLab CI, Jenkins, etc.) are not inherently vulnerable, but the expanded credentials become network-observable to attackers.

Exploitability

Exploitation requires a developer or CI/CD pipeline to clone or install from a malicious repository containing a crafted .npmrc or pnpm-workspace.yaml. No zero-click or automated exploitation occurs; user interaction (cloning the repo, running pnpm install) is necessary. However, the bar for weaponization is low: an attacker need only publish a popular package on a public registry, inject a malicious .npmrc in the source repository, or submit a pull request to an open-source project. The attack surface expands with supply chain trust—developers who frequently evaluate new packages or accept external contributions face higher risk. The vulnerability is not currently tracked in CISA's Known Exploited Vulnerabilities catalog, though the straightforward attack pattern and high-value payload make it attractive for targeted campaigns.

Remediation

Upgrade pnpm to 10.34.2 or later for the 10.x branch, or 11.5.3 or later for the 11.x branch. These versions fix the vulnerability by properly isolating environment variable expansion and preventing repository-controlled config files from leaking local secrets. For teams unable to upgrade immediately, mitigations include: (1) restricting network access from development and build environments to only legitimate package registries; (2) auditing .npmrc and pnpm-workspace.yaml in all active repositories for suspicious registry entries or ${} patterns; (3) using separate, narrowly-scoped API keys for package registry access, so a single leak does not compromise broader infrastructure; and (4) implementing secret rotation policies to limit the window of validity for exposed credentials.

Patch guidance

Patch urgently if your organization runs pnpm on developer workstations or in CI/CD pipelines that process external repositories. Verify your current version by running 'pnpm -v'. If on 10.x, update to 10.34.2 or later; if on 11.x, update to 11.5.3 or later. Check the official pnpm release notes and advisory for version-specific installation instructions. For monorepo and workspace setups, ensure all developers and CI agents run the patched version, as a single old installation can still leak credentials. If using pacquet, check for equivalent patch versions against the project repository.

Detection guidance

Monitor network traffic from pnpm processes for outbound registry requests to unexpected or unauthorized hosts. Log and alert on environment variables being expanded in .npmrc or pnpm-workspace.yaml files during dependency resolution. Review audit logs of cloned repositories and pull requests for suspicious registry entries (e.g., non-standard registry URLs, encoded credentials, or variable references pointing to attacker infrastructure). Scan .npmrc and pnpm-workspace.yaml in your codebase for ${} placeholders that reference sensitive environment variables; flag any matches for manual review. In CI/CD logs, search for evidence of credential exfiltration by examining HTTP headers and registry endpoint logs for unexpected authentication tokens or API keys.

Why prioritize this

Although the CVSS score is 6.5 (medium), the vulnerability warrants rapid prioritization for organizations with active open-source development, monorepo architectures, or high-frequency dependency updates. The attack requires user interaction but offers attackers direct access to environment secrets that may unlock critical infrastructure. The wide adoption of pnpm in the Node.js ecosystem and the low barrier to exploitation make this a credible supply-chain risk. Prioritize patching in CI/CD environments first, followed by developer machines, to reduce the blast radius of potential compromises.

Risk score, explained

The CVSS 3.1 score of 6.5 reflects high confidentiality impact (secrets are leaked), no integrity or availability impact (the attack is passive), no privileges required for exploitation, and low attack complexity (crafting a malicious repository is straightforward). User interaction is required (a developer must clone the repo and run pnpm). The score appropriately captures information disclosure risk but does not account for the downstream impact of leaked credentials—which may enable supply-chain injection, lateral movement, or resource hijacking—making the real-world risk potentially higher in high-trust environments.

Frequently asked questions