CVE-2025-69262

HIGH

7.5

Beschreibung

pnpm is a package manager. Versions 6.25.0 through 10.26.2 have a Command Injection vulnerability when using environment variable substitution in .npmrc configuration files with tokenHelper settings. An attacker who can control environment variables during pnpm operations could achieve Remote Code Execution (RCE) in build environments. This issue is fixed in version 10.27.0.

CVE Details

CVSS v3.1 Bewertung7.5

SchweregradHIGH

CVSS VektorCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

AngriffsvektorLOCAL

KomplexitatHIGH

Erforderliche PrivilegienHIGH

BenutzerinteraktionNONE

Veroffentlicht1/7/2026

Zuletzt geandert1/12/2026

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

pnpm:pnpm

Schwachen (CWE)

CWE-78CWE-94

Referenzen

https://github.com/pnpm/pnpm/releases/tag/v10.27.0(security-advisories@github.com)

https://github.com/pnpm/pnpm/security/advisories/GHSA-2phv-j68v-wwqx(security-advisories@github.com)

https://github.com/pnpm/pnpm/security/advisories/GHSA-2phv-j68v-wwqx(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.