pnpm: Repository config can expand victim environment secrets into registry requests before scripts run (CVE-2026-55180)

pnpm versions before 10.34.2 and 11.5.3 improperly expanded ${ENV_VAR} placeholders from repository-controlled .npmrc and pnpm-workspace.yaml files into registry request destinations and credentials. This behavior could be exploited by a malicious repository to exfiltrate environment secrets from the victim's environment by causing these secrets to be sent to an attacker-controlled registry during dependency resolution, prior to the execution of lifecycle scripts. The vulnerability is addressed in pnpm versions 10.34.2 and 11.5.3.

The vulnerability allows an attacker controlling a repository configuration to cause sensitive environment variables from the victim's environment to be sent to an attacker-chosen registry. This results in confidentiality loss of environment secrets. There is no indication of integrity or availability impact. No known exploits in the wild have been reported.

Upgrade pnpm to version 10.34.2 or later, or 11.5.3 or later, where this vulnerability is fixed. No other mitigation is indicated or required.