{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-50017","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","state":"PUBLISHED","assignerShortName":"GitHub_M","dateReserved":"2026-06-02T22:46:02.579Z","datePublished":"2026-06-25T16:56:04.836Z","dateUpdated":"2026-06-25T16:56:04.836Z"},"containers":{"cna":{"title":"pnpm binds unscoped user-level npm auth credentials to a repository-selected registry","problemTypes":[{"descriptions":[{"cweId":"CWE-200","lang":"en","description":"CWE-200: Exposure of Sensitive Information to an Unauthorized Actor","type":"CWE"}]},{"descriptions":[{"cweId":"CWE-522","lang":"en","description":"CWE-522: Insufficiently Protected Credentials","type":"CWE"}]}],"metrics":[{"cvssV4_0":{"attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"ACTIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","baseScore":6.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0"}}],"references":[{"name":"https://github.com/pnpm/pnpm/security/advisories/GHSA-cjhr-43r9-cfmw","tags":["x_refsource_CONFIRM"],"url":"https://github.com/pnpm/pnpm/security/advisories/GHSA-cjhr-43r9-cfmw"}],"affected":[{"vendor":"pnpm","product":"pnpm","versions":[{"version":"< 10.33.4","status":"affected"},{"version":">= 11.0.0, < 11.4.0","status":"affected"}]}],"providerMetadata":{"orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","shortName":"GitHub_M","dateUpdated":"2026-06-25T16:56:04.836Z"},"descriptions":[{"lang":"en","value":"pnpm is a package manager. Prior to 10.34.0 and 11.4.0, pnpm can send user-level unscoped npm authentication credentials to a registry chosen by a repository-local .npmrc file. In the reproduced case, the user's npm config contains a default registry and an unscoped _authToken. The repository does not provide a token-bearing auth line. It only sets registry= to a different registry URL. During normal pnpm metadata/install workflows, pnpm binds the user-origin unscoped credential to the repository-selected registry and sends it as an Authorization header. This vulnerability is fixed in 10.34.0 and 11.4.0."}],"source":{"advisory":"GHSA-cjhr-43r9-cfmw","discovery":"UNKNOWN"}}}}