pnpm is a package manager.

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Jan 7, 2026 · NIST NVD

   Detected

   pnpm is a package manager. Versions 6.25.0 through 10.26.2 have a Command Injection vulnerability when using environment variable substitution in .npmrc configuration files with tokenHelper settings. An attacker who can control environment variables during pnpm operations could achieve Remote Code Execution (RCE) in build environments. This issue is fixed in version 10.27.0.

2. Oct 14, 2026 · NIST NVD

   Updated

   pnpm is a package manager. Versions 6.25.0 through 10.26.2 have a Command Injection vulnerability when using environment variable substitution in .npmrc configuration files with tokenHelper settings. An attacker who can control environment variables during pnpm operations could achieve Remote Code Execution (RCE) in build environments. This issue is fixed in version 10.27.0.

Affected

• cpe pnpm/pnpmversion unspecified

Sources

• CVE.orgVulnerability recordCVE-2025-69262

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2025-69262

  30-day exploitation probability 1.0%

  first.org
• NIST NVDVulnerability recordCVE-2025-69262

  pnpm is a package manager. Versions 6.25.0 through 10.26.2 have a Command Injection vulnerability when using environment variable substitution in .npmrc configuration files with tokenHelper settings. An attacker who can control environment variables during pnpm operations could a

  nvd.nist.gov

References

• Product · github.com
• Exploit · github.com