Back to Database
Status published
High
CVE-2025-69262
pnpm vulnerable to Command Injection via environment variable substitution
Vulnerability Description
pnpm is a package manager. Versions 6.25.0 through 10.26.2 have a Command Injection vulnerability when using environment variable substitution in .npmrc configuration files with tokenHelper settings. An attacker who can control environment variables during pnpm operations could achieve Remote Code Execution (RCE) in build environments. This issue is fixed in version 10.27.0.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-69262
Credits & Attribution
No credits recorded in the NVD database.
References
More from pnpm
View All →CVE-2025-69264
pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default"
High
8.8
CVE-2025-69263
pnpm Lockfile Integrity Bypass Allows Remote Dynamic Dependencies
High
7.5
CVE-2024-53866
pnpm vulnerable to no-script global cache poisoning via overrides / `ignore-scripts` evasion
Medium
5.8
CVE-2024-47829
pnpm uses the md5 path shortening function causes packet paths to coincide, which causes indirect packet overwriting
Medium
6.5
CVE-2023-37478
pnpm incorrectly parses tar archives relative to specification
High
7.5
Affected Vendor
pnpm
View all reports →Affected Software
pnpm
Vulnerable Versions:
>=6.25.0, < 10.27.0
Timeline
Official Publish:
January 7th, 2026
Last Modified:
February 26th, 2026
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
MITRE ATT&CK TTPs
T1190
Exploit Public-Facing Application
Initial Access
T1059
Command and Scripting Interpreter
Execution
T1068
Exploitation for Privilege Escalation
Privilege Escalation
T1005
Data from Local System
Collection
T1041
Exfiltration Over C2 Channel
Exfiltration
T1505.003
Web Shell
Persistence
T1105
Ingress Tool Transfer
Command and Control
T1565.002
Stored Data Manipulation
Impact