High severity7.5OSV Advisory· Published Jan 7, 2026· Updated Jun 22, 2026

CVE-2025-69262

Description

pnpm is a package manager. Versions 6.25.0 through 10.26.2 have a Command Injection vulnerability when using environment variable substitution in .npmrc configuration files with tokenHelper settings. An attacker who can control environment variables during pnpm operations could achieve Remote Code Execution (RCE) in build environments. This issue is fixed in version 10.27.0.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
pnpmnpm	>= 6.25.0, < 10.27.0	10.27.0

Affected products

Pnpm/PnpmOSV2 versions
v1, v10.0.0, v10.0.0-alpha.0, …+ 1 more
- (no CPE)range: v1, v10.0.0, v10.0.0-alpha.0, …
- cpe:2.3:a:pnpm:pnpm:*:*:*:*:*:node.js:*:*range: >=6.25.0,<10.27.0
ghsa-coords
pkg:npm/pnpm
Range: >= 6.25.0, < 10.27.0

Patches

Vulnerability mechanics

References

github.com/pnpm/pnpm/security/advisories/GHSA-2phv-j68v-wwqxnvdExploitVendor AdvisoryWEB
github.com/advisories/GHSA-2phv-j68v-wwqxghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-69262ghsaADVISORY
github.com/pnpm/pnpm/releases/tag/v10.27.0nvdProductRelease NotesWEB

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000