Insertion of Sensitive Information Into Sent Data Affecting @pnpm/config package, versions >=1002.5.3 <1004.11.6

Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data exposing process environment values, in getOptionsFromRootManifest.ts, which expands ${VAR} placeholders in the httpProxy, httpsProxy, and noProxy settings read from a repository-controlled manifest. An attacker can exfiltrate environment secrets such as NPM_TOKEN or GITHUB_TOKEN by publishing a repository whose pnpm-workspace.yaml sets a proxy URL that embeds ${VAR} in its hostname or userinfo, so the victim's pnpm install routes install traffic through the attacker proxy and leaks the expanded value. This requires the victim to run pnpm install in the untrusted repository with the relevant secrets present in the environment.

This vulnerability can be avoided by inspecting an untrusted repository's pnpm-workspace.yaml for httpProxy, httpsProxy, and noProxy settings before running install, or by running pnpm in an environment that does not hold the secrets.

• GitHub Advisory
• GitHub Commit
• GitHub Commit
• GitHub Discussion
• GitHub PR
• GitHub PR
• GitHub Release
• GitHub Release