PT-2026-1939 · Pnpm · Pnpm
CVE-2025-69262
·
Published
2026-01-07
·
Updated
2026-06-22
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
pnpm versions 6.25.0 through 10.26.2
Description
pnpm is a package manager susceptible to a Command Injection issue when utilizing environment variable substitution within .npmrc configuration files, specifically with tokenHelper settings enabled. An attacker capable of controlling environment variables during pnpm operations could potentially achieve Remote Code Execution (RCE) in build environments.
Recommendations
Update to pnpm version 10.27.0 or later.
Exploit
Fix
RCE
Code Injection
OS Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Pnpm