Security Advisory

CVE-2025-69262

CVE vulnerability detail — eXtreme Datacenter Security Operations

Published 2026-01-07 22:30:07

Last updated 2026-02-26 15:04:55

Assigner GitHub_M

State PUBLISHED

Description

pnpm is a package manager. Versions 6.25.0 through 10.26.2 have a Command Injection vulnerability when using environment variable substitution in .npmrc configuration files with tokenHelper settings. An attacker who can control environment variables during pnpm operations could achieve Remote Code Execution (RCE) in build environments. This issue is fixed in version 10.27.0.

← Browse all CVEs View on cve.org ↗