CVE-2025-69262

The record

pnpm is a package manager. Versions 6.25.0 through 10.26.2 have a Command Injection vulnerability when using environment variable substitution in .npmrc configuration files with tokenHelper settings. An attacker who can control environment variables during pnpm operations could achieve Remote Code Execution (RCE) in build environments. This issue is fixed in version 10.27.0.

Affected packages

Related vulnerabilities

• GHSA-2phv-j68v-wwqx pnpm vulnerable to Command Injection via environment variable substitution Same vulnerability
• GHSA-v253-rj99-jwpq pnpm has Path Traversal via arbitrary file permission modification Also affects pnpm
• GHSA-6pfh-p556-v868 pnpm: Binary ZIP extraction allows arbitrary file write via path traversal (Zip Slip) Also affects pnpm
• GHSA-6x96-7vc8-cm3p pnpm has Windows-specific tarball Path Traversal Also affects pnpm
• GHSA-xpqm-wm3m-f34h pnpm scoped bin name Path Traversal allows arbitrary file creation outside… Also affects pnpm
• GHSA-m733-5w8f-5ggw pnpm has symlink traversal in file:/git dependencies Also affects pnpm
• CVE-2026-24056 pnpm has symlink traversal in file:/git dependencies Also affects pnpm
• CVE-2026-23890 pnpm scoped bin name Path Traversal allows arbitrary file creation outside… Also affects pnpm