CVE-2026-55180: Pnpm

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm and pacquet expanded ${ENV_VAR} placeholders from repository-controlled .npmrc and pnpm-workspace.yaml into registry request destinations and registry credentials. A malicious repository could cause dependency resolution to send victim environment secrets to an attacker-selected registry before lifecycle scripts run. This vulnerability is fixed in 10.34.2 and 11.5.3.

Affected products

• Pnpm Pnpm: before 10.34.2 (fixed in 10.34.2); from 11.0.0, before 11.5.3 (fixed in 11.5.3)

Published 2026-06-25. Last modified 2026-06-29.