PT-2026-1939 · Pnpm · Pnpm

Published 2026-01-07 · Updated 2026-01-08 · CVE-2025-69262

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pnpm versions 6.25.0 through 10.26.2

Description pnpm is a package manager susceptible to a Command Injection issue when utilizing environment variable substitution within .npmrc configuration files, specifically with tokenHelper settings enabled. An attacker capable of controlling environment variables during pnpm operations could potentially achieve Remote Code Execution (RCE) in build environments.

Recommendations Update to pnpm version 10.27.0 or later.

Exploit

Fix

RCE

OS Command Injection

Code Injection

Weakness Enumeration

CWE-78

CWE-94

Related Identifiers

CVE-2025-69262

GHSA-2PHV-J68V-WWQX

Affected Products

Pnpm

References · 10

• 🔥 https://github.com/pnpm/pnpm/security/advisories/GHSA-2phv-j68v-wwqx · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69262.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-69262 · Security Note
• https://osv.dev/vulnerability/CVE-2025-69262 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2phv-j68v-wwqx · Vendor Advisory
• https://github.com/pnpm/pnpm/releases/tag/v10.27.0 · Note
• https://github.com/pnpm/pnpm · Note
• https://t.me/cveNotify/148008 · Telegram Post
• https://twitter.com/CVEnew/status/2009032504809017766 · Twitter Post
• https://t.me/CVEtracker/41655 · Telegram Post