Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm and pacquet expanded ${ENV_VAR} placeholders from repository-controlled .npmrc and pnpm-workspace.yaml into registry request destinations and registry credentials. A malicious repository could cause dependency resolution to send victim environment secrets to an attacker-selected registry before lifecycle scripts run. This vulnerability is fixed in 10.34.2 and 11.5.3.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-06-25 | 2 | General1Patch1 |
| 2026-06-27 | 1 | Disclosure1 |
| 2026-09-01 | 1 | Disclosure1 |
🟠 pnpm, Environment Variable Expansion via Proxy Settings, #CVE-2026-55180 (Medium) -DC-Sep2026-2063 https://dailycve.com/pnpm-environment-variable-expansion-via-proxy-settings-cve-2026-55180-medium-dc-sep2026-2063/
Post summary
A medium‑severity vulnerability (CVE‑2026‑55180) involving environment variable expansion via proxy settings in pnpm has been disclosed, with further details available on the linked DailyCVE page.
🔴 pnpm, Information Disclosure, #CVE-2026-55180 (High) -DC-Jun2026-712 https://dailycve.com/pnpm-information-disclosure-cve-2026-55180-high-dc-jun2026-712/
Post summary
The post announces a newly identified information disclosure vulnerability in pnpm (CVE‑2026‑55180) with high severity, providing a link for further details.
CVE-2026-55180 Environment Variable Injection in pnpm Package Manager Versions B... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-55180 Vulnerability Alert Subscriptions: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=1
Post summary
The post merely announces the existence of CVE-2026-55180 with a link to a vulnerability database, providing no further detail on exploitation, patches, or technical specifics.
CVE-2026-55180 pnpm is a package manager. Prior to 10.34.2 and 11.5.3, pnpm and pacquet expanded ${ENV_VAR} placeholders from repository-controlled .npmrc and pnpm-workspace.yaml in… https://www.cve.org/CVERecord?id=CVE-2026-55180
Post summary
The snippet reports a CVE involving environment variable expansion in pnpm, noting that versions 10.34.2 and 11.5.3 contain a fix; no exploit, PoC, or active use details are present.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | pnpm | pnpm | - | node.js | - |