CVE-2026-55180: pnpm: Repository config can expand victim environment secrets into registry requests before scripts run

June 26, 2026

pnpm and pacquet expanded ${ENV_VAR} placeholders from repository-controlled .npmrc and pnpm-workspace.yaml into registry request destinations and registry credentials. A malicious repository could cause dependency resolution to send victim environment secrets to an attacker-selected registry before lifecycle scripts run.

References

github.com/advisories/GHSA-3qhv-2rgh-x77r
github.com/pnpm/pnpm/security/advisories/GHSA-3qhv-2rgh-x77r
nvd.nist.gov/vuln/detail/CVE-2026-55180

Code Behaviors & Features

Detect and mitigate CVE-2026-55180 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →