Is CVE-2026-101043 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-101043 being exploited in the wild.

How severe is CVE-2026-101043?

High severity, with a CVSS score of 7.4, published 27 September 2026.

Which products and versions are affected?

Pnpm >=11.0.0, =10.7.0, <10.34.5.

Is there a fix for CVE-2026-101043?

A patch was published on 2026-09-27: pnpm 11.11.0 and 10.34.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-101043 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-101043?

Check whether you run Pnpm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-101043: pnpm environment variable exfiltration via proxy settings

Q: Is there a fix for CVE-2026-101043?

A patch was published on 2026-09-27: pnpm 11.11.0 and 10.34.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-101043 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-101043?

Check whether you run Pnpm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-101043 · Severity: high · CVSS 7.4 · Published 2026-09-27

pnpm is a Node.js package manager that installs dependencies for JavaScript projects. When a developer clones a malicious repository and runs pnpm install, an attacker can inject environment variable placeholders into proxy settings in the project's configuration file. This causes pnpm to expose sensitive credentials like NPM_TOKEN or GITHUB_TOKEN by routing traffic through an attacker-controlled server, leaking secrets before any project code executes.

Technologies: Pnpm. Vendors: Pnpm.

Quick answers

Is CVE-2026-101043 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-101043 being exploited in the wild.
How severe is CVE-2026-101043?: High severity, with a CVSS score of 7.4, published 27 September 2026.
Which products and versions are affected?: Pnpm >=11.0.0, <11.11.0 and >=10.7.0, <10.34.5.
Is there a fix for CVE-2026-101043?: A patch was published on 2026-09-27: pnpm 11.11.0 and 10.34.5 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-101043 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-101043?: Check whether you run Pnpm at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

pnpm expands ${VAR} environment-variable placeholders in httpProxy, httpsProxy, and noProxy settings read from pnpm-workspace.yaml. These proxy configuration keys were omitted from the request-destination key set that suppresses placeholder expansion for untrusted manifests, creating a bypass of an existing security boundary already applied to registry and pnprServer keys. An attacker controlling a repository's pnpm-workspace.yaml can embed environment secrets into proxy hostnames or userinfo, exfiltrating them during configuration loading via DNS lookups and HTTP requests to the attacker's host, requiring only user interaction (cloning and running pnpm).

Affected products

pnpm pnpm >=11.0.0, <11.11.0 and >=10.7.0, <10.34.5

Timeline

2026-09-27: disclosed
2026-09-27: patched: pnpm 11.11.0 and 10.34.5

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.