THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-vx52-2968-3vc6 (high) — pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml

[GHSA] GHSA-vx52-2968-3vc6 (high) — pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml

highgithub_advisoriesPublished 2026-09-01

GHSA-vx52-2968-3vc6 Severity: high CVE: None

pnpm: Environment secrets exfiltrated via env-placeholder expansion in proxy settings read from an untrusted pnpm-workspace.yaml

## Summary

pnpm expands `${VAR}` environment placeholders in the `httpProxy` / `httpsProxy` / `noProxy` settings read from a project's `pnpm-workspace.yaml`. Because a project manifest is repository-controlled, a malicious

Indicators of compromise

http://${PNPM_TEST_TOKEN}.evil/url
http://secret.evil/url

Original source: https://github.com/advisories/GHSA-vx52-2968-3vc6