What’s Vulnerable › Vulnerabilities

CVE-2025-69262: pnpm vulnerable to Command Injection via environment variable substitution

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-01-07 · updated 2026-10-14
• Weakness: CWE-78

Description

pnpm is a package manager. Versions 6.25.0 through 10.26.2 have a Command Injection vulnerability when using environment variable substitution in .npmrc configuration files with tokenHelper settings. An attacker who can control environment variables during pnpm operations could achieve Remote Code Execution (RCE) in build environments. This issue is fixed in version 10.27.0.

Affected products

• pnpm: from 6.25.0 before 10.27.0 — fixed in 10.27.0

How to fix

Upgrade to a fixed version: pnpm 10.27.0. Check the vendor advisory for mitigations.

References

• https://github.com/pnpm/pnpm/releases/tag/v10.27.0
• https://github.com/pnpm/pnpm/security/advisories/GHSA-2phv-j68v-wwqx
• https://github.com/pnpm/pnpm/security/advisories/GHSA-2phv-j68v-wwqx

Get alerted when CVE-2025-69262 or the next vulnerability affects your stack