Packages / pnpm / Security

HighVulnerabilityGHSA-vx52-2968-3vc6Published 1 Sept 2026

pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml

Affected · pnpm

  • >= 11.0.0, < 11.11.0
  • >= 10.7.0, < 10.34.5

Fixed in

11.11.0

npm install pnpm@11.11.0

  1. Not affected

    0.0.1 – 10.6.5

    882 releases

  2. Affected

    10.7.0 – 10.34.4

    60 releases

  3. Fixed

    10.34.5 – 10.34.7

    3 releases

  4. Affected

    11.0.0 – 11.10.0

    28 releases

  5. Fixed

    11.11.0 – 12.14.0

    57 releases, latest

1030 stable releases of pnpm, oldest to newest.

What happens

The full text is not stored yet. Read it on osv.dev.