CVE-2025-69262

HIGH

7.5

Description

pnpm is a package manager. Versions 6.25.0 through 10.26.2 have a Command Injection vulnerability when using environment variable substitution in .npmrc configuration files with tokenHelper settings. An attacker who can control environment variables during pnpm operations could achieve Remote Code Execution (RCE) in build environments. This issue is fixed in version 10.27.0.

CVE Details

CVSS v3.1 Score7.5

SeverityHIGH

CVSS VectorCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack VectorLOCAL

ComplexityHIGH

Privileges RequiredHIGH

User InteractionNONE

Published1/7/2026

Last Modified1/12/2026

Sourcenvd

Honeypot Sightings0

Affected Products

pnpm:pnpm

Weaknesses (CWE)

CWE-78CWE-94

References

https://github.com/pnpm/pnpm/releases/tag/v10.27.0(security-advisories@github.com)

https://github.com/pnpm/pnpm/security/advisories/GHSA-2phv-j68v-wwqx(security-advisories@github.com)

https://github.com/pnpm/pnpm/security/advisories/GHSA-2phv-j68v-wwqx(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.