Environment Variable Injection in pnpm Package Manager

Detection Guidance

To detect this vulnerability on your system, you should first check the version of pnpm or pacquet installed to see if it is prior to the fixed versions 10.34.2 or 11.5.3.

• Run `pnpm --version` to determine the installed pnpm version.

Additionally, inspect your project-level configuration files (.npmrc and pnpm-workspace.yaml) for any usage of environment variable placeholders like ${ENV_VAR}, especially in registry URLs or authentication credentials.

• Use commands like `grep -r '\${' .npmrc pnpm-workspace.yaml` in your project directory to find environment variable placeholders.

On the network level, monitor outgoing requests from your build or development environment to detect any unexpected registry destinations that might be attacker-controlled.

• Use network monitoring tools or commands such as `tcpdump` or `wireshark` to capture and analyze registry request destinations for suspicious URLs.

Useful 0 Not Useful 0

Executive Summary

This vulnerability affects the pnpm package manager. Before versions 10.34.2 and 11.5.3, pnpm and pacquet would expand environment variable placeholders (${ENV_VAR}) found in repository-controlled configuration files (.npmrc and pnpm-workspace.yaml) into registry request destinations and credentials.

Because these placeholders could include sensitive environment secrets, a malicious repository could exploit this behavior to send those secrets to an attacker-controlled registry during dependency resolution, before any lifecycle scripts run.

This means that simply by depending on a malicious repository, a user could unintentionally leak sensitive environment variables to an attacker.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to the unintended disclosure of sensitive environment secrets to an attacker-controlled registry.

This could compromise confidential information such as API keys, tokens, or other environment variables that are used during package installation.

Such a leak could enable attackers to gain unauthorized access to systems or services, potentially leading to further security breaches.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, update pnpm to version 10.34.2 or later, or 11.5.3 or later, where the issue is fixed.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows a malicious repository to exfiltrate sensitive environment secrets, such as CI job tokens or npm tokens, to an attacker-controlled registry. Such unauthorized disclosure of sensitive information could lead to violations of data protection standards and regulations that require safeguarding of confidential data.

Because environment secrets may include credentials or tokens that could be linked to personal or organizational data, their leakage could impact compliance with regulations like GDPR or HIPAA, which mandate strict controls over access and disclosure of sensitive information.

Therefore, exploitation of this vulnerability could result in non-compliance with these standards due to the potential unauthorized exposure of sensitive environment data.

Useful 0 Not Useful 0