CVE-2026-50017: pnpm credential leak via repository-local registry configuration

Executive brief

pnpm, a popular JavaScript package manager, contains a vulnerability that can leak sensitive registry authentication tokens. If a developer or automated system runs pnpm commands within a malicious repository, the repository can redirect pnpm to an untrusted server while tricking it into sending the user's private login credentials. This could allow an attacker to steal credentials used to access private software packages, potentially leading to unauthorized access to proprietary code.

Technical details

A credential leakage vulnerability exists in pnpm's auth-header logic. When a repository-local `.npmrc` file overrides the default registry URL, pnpm may still attach unscoped `_authToken`, `_auth`, or username/password credentials from the user's global configuration to requests sent to the new, potentially untrusted registry. This occurs because pnpm binds default (unscoped) credentials to the effective registry without verifying if the registry was changed by a lower-trust configuration layer. An attacker can exploit this by providing a malicious repository with a custom `registry` setting in `.npmrc`, capturing the victim's credentials when they run `pnpm install` or `pnpm view`. The issue is fixed in versions 10.34.0 and 11.4.0.

Affected products

• pnpm pnpm < 10.34.0, >= 11.0.0 < 11.4.0

Timeline

• 2026-05-28: advisory: Initial GHSA publication
• 2026-06-26: patched: Updated with patch information and CVE-2026-50017

References

• https://api.github.com/users/mosskappa
• https://github.com/mosskappa
• https://api.github.com/users/mosskappa/gists%7B/gist_id%7D
• https://api.github.com/users/mosskappa/repos
• https://avatars.githubusercontent.com/u/205706019?v=4
• https://api.github.com/users/mosskappa/events%7B/privacy%7D