CVE-2025-69262highCWE-78CWE-94

CVE-2025-69262: high-severity vulnerability in pnpm

pnpm vulnerable to Command Injection via environment variable substitution

Published · Updated

Follow this CVE+ Monitor pnpm+ Monitor pnpm

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.6epss 1.0%
pnpm is a package manager. Versions 6.25.0 through 10.26.2 have a Command Injection vulnerability when using environment variable substitution in .npmrc configuration files with tokenHelper settings. An attacker who can control environment variables during pnpm operations could achieve Remote Code Execution (RCE) in build environments. This issue is fixed in version 10.27.0.
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Affected products
pnpm · pnpm
Related CVEs — pnpm

In the same product, most dangerous first.

CVE-2023-37478HIGHpnpm incorrectly parses tar archives relative to specificationEPSS 1.2%CVE-2025-69264HIGHpnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default"EPSS 1.0%CVE-2024-53866MEDIUMpnpm vulnerable to no-script global cache poisoning via overrides / `ignore-scripts` evasionEPSS 1.0%CVE-2026-82393HIGHpnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on installEPSS 0.6%CVE-2026-82392HIGHpnpm: Virtual store linker path traversal via unvalidated depPath name in lockfileToDepGraphEPSS 0.6%CVE-2026-50016HIGHpnpm: Transitive dependency alias path traversal allows project path override via symlink replacementEPSS 0.5%