CVE-2026-50017 Details
Description
pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm can send user-level unscoped npm authentication credentials to a registry chosen by a repository-local .npmrc file. In the reproduced case, the user's npm config contains a default registry and an unscoped _authToken. The repository does not provide a token-bearing auth line. It only sets registry= to a different registry URL. During normal pnpm metadata/install workflows, pnpm binds the user-origin unscoped credential to the repository-selected registry and sends it as an Authorization header. This vulnerability is fixed in 10.34.0 and 11.4.0.
A vulnerability in pnpm, a package manager, allows for the unintentional transmission of user-level unscoped npm authentication tokens to a registry specified by a repository-local .npmrc file. This issue is present in pnpm versions prior to 10.34.0 and in the 11.0.0 through 11.4.0 range. The vulnerability arises when a repository's .npmrc file directs pnpm to a different registry without including an authentication token, yet the user's npm configuration contains a default registry and an unscoped authentication token. During standard pnpm operations, the tool sends the user's unscoped credentials to the registry selected by the repository, effectively binding higher-trust credentials to a lower-trust registry.
Users can update to pnpm version 10.34.0 or 11.4.0 and later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pnpm/pnpm/security/advisories/GHSA-cjhr-43r9-cfmw | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-522 | Insufficiently Protected Credentials | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| pnpm pnpm | < 10.34.0 >= 11.0.0, < 11.4.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 30, 2026 | Initial Analysis | [email protected] |
| Jun 26, 2026 | CVE Modified | CISA-ADP |
| Jun 25, 2026 | New CVE Received | [email protected] |