AIKIDO-2026-329705
@pnpm/exe is vulnerable to Information Disclosure
59
Medium Risk
This Affects:
@pnpm/exeTL;DR
pnpm's publish and dist tag commands read the trusted publishing NPM_ID_TOKEN OIDC identity token from the CI environment and forward it as a bearer credential to the configured registry. Before this fix, pnpm uses that token without checking its aud claim against the registry it is about to call, so a token minted for one registry can be sent to a different one. This discloses the trusted publishing identity credential to an unintended registry endpoint, which can then replay the credential against the registry it was actually issued for. The fix validates the token audience against the selected registry before use and skips a token that does not match.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you publish packages or manage dist tags using OIDC trusted publishing with a registry configuration that can resolve to more than one registry endpoint.
Background info
@pnpm/exe is vulnerable to Information Disclosure in versions 10.0.0 - 12.12.0.
How to fix this
Upgrade the @pnpm/exe library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.