CVE-2025-69262

HIGH

7.5

Descripcion

pnpm is a package manager. Versions 6.25.0 through 10.26.2 have a Command Injection vulnerability when using environment variable substitution in .npmrc configuration files with tokenHelper settings. An attacker who can control environment variables during pnpm operations could achieve Remote Code Execution (RCE) in build environments. This issue is fixed in version 10.27.0.

Detalles CVE

Puntuacion CVSS v3.17.5

SeveridadHIGH

Vector CVSSCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Vector de ataqueLOCAL

ComplejidadHIGH

Privilegios requeridosHIGH

Interaccion usuarioNONE

Publicado1/7/2026

Ultima modificacion1/12/2026

Fuentenvd

Avistamientos honeypot0

Productos afectados

pnpm:pnpm

Debilidades (CWE)

CWE-78CWE-94

Referencias

https://github.com/pnpm/pnpm/releases/tag/v10.27.0(security-advisories@github.com)

https://github.com/pnpm/pnpm/security/advisories/GHSA-2phv-j68v-wwqx(security-advisories@github.com)

https://github.com/pnpm/pnpm/security/advisories/GHSA-2phv-j68v-wwqx(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.