https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 15:08:10 +0000 https://vulnerability.circl.lu/vuln/cve-2026-50017 <p><strong>Affected:</strong> pnpm</p> <p>pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm can send user-level unscoped npm authentication credentials to a registry chosen by a repository-local .npmrc file. In the reproduced case, the user&#39;s npm config contains a default registry and an unscoped _authToken. The repository does not provide a token-bearing auth line. It only sets registry= to a different registry URL. During normal pnpm metadata/install workflows, pnpm binds the user-origin unscoped credential to the repository-selected registry and sends it as an Authorization header. This vulnerability is fixed in 10.34.0 and 11.4.0.</p> <p><strong>Affected:</strong> pnpm</p> <p>pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm can send user-level unscoped npm authentication credentials to a registry chosen by a repository-local .npmrc file. In the reproduced case, the user&#39;s npm config contains a default registry and an unscoped _authToken. The repository does not provide a token-bearing auth line. It only sets registry= to a different registry URL. During normal pnpm metadata/install workflows, pnpm binds the user-origin unscoped credential to the repository-selected registry and sends it as an Authorization header. This vulnerability is fixed in 10.34.0 and 11.4.0.</p> https://vulnerability.circl.lu/vuln/cve-2026-50017 https://vulnerability.circl.lu/vuln/ghsa-cjhr-43r9-cfmw <p><strong>Affected:</strong> npm: pnpm</p> <p>## Summary</p> <p>pnpm can send user-level unscoped npm authentication credentials to a registry chosen by a repository-local `.npmrc` file.</p> <p>In the reproduced case, the user&#39;s npm config contains a default registry and an unscoped `_authToken`. The repository does not provide a token-bearing auth line. It only sets `registry=` to a different registry URL. During normal pnpm metadata/install workflows, pnpm binds the user-origin unscoped credential to the repository-selected registry and sends it as an `Authorization` header.</p> <p>This was reproduced with fake credentials and loopback registries only. No third-party registry or real token was used.</p> <p>## Affected Behavior Observed</p> <p>Observed affected:</p> <p>- pnpm `10.33.2`: `pnpm install --ignore-scripts` sends the user-level unscoped `_authToken` to the repository-selected registry. - pnpm `11.1.3`: `pnpm install --ignore-scripts` sends the user-level unscoped `_authToken` to the repository-selected registry. - pnpm `11.2.1` (`next-11` dist tag at testing time): `pnpm install --ignore-scripts` sends the user-level unscoped `_authToken` to the repository-selected registry. - pnpm `11.1.3`: `pnpm view` also sends user-level unscoped `_authToken`, `_auth`, and `username` / `_password` credentials to the repository-selected registry in the local loopback replay.</p> <p>Control:</p> <p>- npm `10.9.7` rejects the same unscoped user `_authToken` configuration with `ERR_INVALID_AUTH` and does not send an `Authorization` header to the repository-selected regis…</p> <p><strong>Affected:</strong> npm: pnpm</p> <p>## Summary</p> <p>pnpm can send user-level unscoped npm authentication credentials to a registry chosen by a repository-local `.npmrc` file.</p> <p>In the reproduced case, the user&#39;s npm config contains a default registry and an unscoped `_authToken`. The repository does not provide a token-bearing auth line. It only sets `registry=` to a different registry URL. During normal pnpm metadata/install workflows, pnpm binds the user-origin unscoped credential to the repository-selected registry and sends it as an `Authorization` header.</p> <p>This was reproduced with fake credentials and loopback registries only. No third-party registry or real token was used.</p> <p>## Affected Behavior Observed</p> <p>Observed affected:</p> <p>- pnpm `10.33.2`: `pnpm install --ignore-scripts` sends the user-level unscoped `_authToken` to the repository-selected registry. - pnpm `11.1.3`: `pnpm install --ignore-scripts` sends the user-level unscoped `_authToken` to the repository-selected registry. - pnpm `11.2.1` (`next-11` dist tag at testing time): `pnpm install --ignore-scripts` sends the user-level unscoped `_authToken` to the repository-selected registry. - pnpm `11.1.3`: `pnpm view` also sends user-level unscoped `_authToken`, `_auth`, and `username` / `_password` credentials to the repository-selected registry in the local loopback replay.</p> <p>Control:</p> <p>- npm `10.9.7` rejects the same unscoped user `_authToken` configuration with `ERR_INVALID_AUTH` and does not send an `Authorization` header to the repository-selected regis…</p> https://vulnerability.circl.lu/vuln/ghsa-cjhr-43r9-cfmw