Skip to content
Threat Feed
Subscribe

Product

Pnpm (< 10.34.5, >= 11.0.0, < 11.11.0)

1 brief RSS
high advisory

Environment Secret Exfiltration via pnpm-workspace.yaml Proxy Settings

A vulnerability in pnpm allows local environment variable exfiltration when a user executes 'pnpm install' in a malicious repository containing a crafted 'pnpm-workspace.yaml' file.

pnpm +3 supply-chain exfiltration vulnerability path-traversal
5t updated