CVE-2025-69262

HIGH

7.5

Descricao

pnpm is a package manager. Versions 6.25.0 through 10.26.2 have a Command Injection vulnerability when using environment variable substitution in .npmrc configuration files with tokenHelper settings. An attacker who can control environment variables during pnpm operations could achieve Remote Code Execution (RCE) in build environments. This issue is fixed in version 10.27.0.

Detalhes CVE

Pontuacao CVSS v3.17.5

SeveridadeHIGH

Vetor CVSSCVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Vetor de ataqueLOCAL

ComplexidadeHIGH

Privilegios necessariosHIGH

Interacao do usuarioNONE

Publicado1/7/2026

Ultima modificacao1/12/2026

Fontenvd

Avistamentos honeypot0

Produtos afetados

pnpm:pnpm

Fraquezas (CWE)

CWE-78CWE-94

Referencias

https://github.com/pnpm/pnpm/releases/tag/v10.27.0(security-advisories@github.com)

https://github.com/pnpm/pnpm/security/advisories/GHSA-2phv-j68v-wwqx(security-advisories@github.com)

https://github.com/pnpm/pnpm/security/advisories/GHSA-2phv-j68v-wwqx(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.