CVE-2026-101043 | pnpm up to 11.10.x/10.34.4 Placeholder Expansion pnpm-workspace.yaml os command injection

September 27, 2026 Yanac

A vulnerability was found in pnpm up to 11.10.x/10.34.4 and classified as problematic. Impacted is an unknown function of the file pnpm-workspace.yaml of the component Placeholder Expansion. Executing a manipulation can lead to os command injection.

This vulnerability is tracked as CVE-2026-101043. The attack can be launched remotely. No exploit exists.

It is suggested to upgrade the affected component.VulDB Recent EntriesRead More