Vulnerability · Published Jan 7, 2026 · Assigned by GitHub_M

CVE-2025-69262pnpm vulnerable to Command Injection via environment variable substitution

High 7.6

In plain English

A high-severity OS command injection in pnpm from pnpm. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.6High

Exploit odds (30 days)1.0%top 35.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

pnpm is a package manager. Versions 6.25.0 through 10.26.2 have a Command Injection vulnerability when using environment variable substitution in .npmrc configuration files with tokenHelper settings. An attacker who can control environment variables during pnpm operations could achieve Remote Code Execution (RCE) in build environments. This issue is fixed in version 10.27.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Alpine:v3.23	pnpm	10.33.4-r0	ALPINE-CVE-2025-69262
npm	pnpm	10.27.0	GHSA-2phv-j68v-wwqx

Affected products (as reported)

Vendor	Product	Versions
pnpm	pnpm	>=6.25.0, < 10.27.0

Weakness: CWE-78, CWE-94 · Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

References

https://github.com/pnpm/pnpm/security/advisories/GHSA-2phv-j68v-wwqx x_refsource_CONFIRM
https://github.com/pnpm/pnpm/releases/tag/v10.27.0 x_refsource_MISC