CVE-2026-50017

pnpm binds unscoped user-level npm auth credentials to a repository-selected registry

Published Jun 25, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Description

pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm can send user-level unscoped npm authentication credentials to a registry chosen by a repository-local .npmrc file. In the reproduced case, the user's npm config contains a default registry and an unscoped _authToken. The repository does not provide a token-bearing auth line. It only sets registry= to a different registry URL. During normal pnpm metadata/install workflows, pnpm binds the user-origin unscoped credential to the repository-selected registry and sends it as an Authorization header. This vulnerability is fixed in 10.34.0 and 11.4.0.

Analysis

Technical impact

pnpm, a widely used package manager, incorrectly associates a user’s unscoped npm authentication token with a registry specified in a repository’s local .npmrc file. In releases before 10.34.0 and 11.4.0 the token is transmitted as an Authorization header to the registry chosen by that .npmrc, exposing the token to the registry host. This can enable an attacker to impersonate the user, access private packages, or conduct further malicious activity. The vulnerability involves credential storage (CWE‑201).

Affected Systems

pnpm 10.x versions earlier than 10.34.0 and 11.x versions earlier than 11.4.0 are vulnerable. The issue occurs when a repository’s .npmrc sets the registry property without providing an explicit authentication entry.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity. The EPSS score of < 1% denotes a very low exploitation probability, and the vulnerability is not listed in CISA KEV, which suggests the risk to unpatched environments is currently limited. Based on the most likely attack vector, a repository maintainer or collaborator could place a malicious .npmrc file in a project, configuring the registry to point to an attacker’s server, which results in the token being sent as an Authorization header to that remote registry.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

pnpm

affected

Version	Status	Constraints
`< 10.33.4`	affected	—
`>= 11.0.0, < 11.4.0`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:pnpm:pnpm::::::node.js::*
	cpe:2.3:a:pnpm:pnpm::::::node.js::*

No data.

Vendor Product Versions

Pnpm

Version	Status	Scheme	Platform
`[0,10.33.4)`	affected	semver	—
`[11.0.0,11.4.0)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade pnpm to version 10.34.0 or later, or 11.4.0 or later, to apply the fixed logic.
Audit any repository .npmrc files to remove or restrict registry overrides until the upgrade is complete, ensuring that only trusted registries are referenced.
Continuously monitor network traffic from pnpm operations for unexpected Authorization headers and verify that no credentials are being transmitted to untrusted registries.

Generated by OpenCVE AI on July 31, 2026 at 16:57 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-cjhr-43r9-cfmw	pnpm binds unscoped user-level npm auth credentials to a repository-selected registry

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction Active

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.437% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/pnpm/pnpm/security/advisories/GHSA-cjhr-43r9-cfmw
https://nvd.nist.gov/vuln/detail/CVE-2026-50017
https://www.cve.org/CVERecord?id=CVE-2026-50017

History

Jul 7, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-201
References		https://nvd.nist.gov/vuln/detail/CVE-2026-50017 https://www.cve.org/CVERecord?id=CVE-2026-50017
Metrics	threat_severity `None`	cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}` threat_severity `Moderate`

Jun 26, 2026 7:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 25, 2026 10:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Pnpm Pnpm pnpm
Vendors & Products		Pnpm Pnpm pnpm

Jun 25, 2026 5:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm can send user-level unscoped npm authentication credentials to a registry chosen by a repository-local .npmrc file. In the reproduced case, the user's npm config contains a default registry and an unscoped _authToken. The repository does not provide a token-bearing auth line. It only sets registry= to a different registry URL. During normal pnpm metadata/install workflows, pnpm binds the user-origin unscoped credential to the repository-selected registry and sends it as an Authorization header. This vulnerability is fixed in 10.34.0 and 11.4.0.
Title		pnpm binds unscoped user-level npm auth credentials to a repository-selected registry
Weaknesses		CWE-200 CWE-522
References		https://github.com/pnpm/pnpm/security/advisories/GHSA-cjhr-43r9-cfmw
Metrics		cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}`