CVE-2025-69262High· 7.5▾ Twilightpnpm is a package manager. Versions 6.25.0 through 10.26.2 have a Command Injection vulnerability when using environment variable substitution in .npmrc configuration files with tokenHelper settings. An attacker who can control environme…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.9%
0.9% → 1.1%
Last analysed / modified upstream
pnpm is a package manager. Versions 6.25.0 through 10.26.2 have a Command Injection vulnerability when using environment variable substitution in .npmrc configuration files with tokenHelper settings. An attacker who can control environment variables during pnpm operations could achieve Remote Code Execution (RCE) in build environments. This issue is fixed in version 10.27.0.
pnpm >= 6.25.0, < 10.27.0Upgrade past the affected range:
pnpm 10.27.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-82393High· 7.5pnpm is a package manager
CVE-2026-101043High· 7.4pnpm versions 11.0.0 before 11.11.0 and 10.7.0 before 10.34.5 expand ${VAR} environment-variable placeholders in the httpProxy, httpsProxy, and noProxy settings read from a project's pnpm-workspace.yaml
CVE-2026-101044High· 7.1pacquet, the Rust package-manager component shipped in the pnpm npm package versions >=12.0.0-alpha.0 and <12.0.0-alpha.5, does not validate dependency alias/name paths taken from a lockfile before using them in install-time filesystem j…
CVE-2026-82392High· 7.1pnpm is a package manager
CVE-2025-69264High· 8.8pnpm is a package manager
CVE-2025-69263High· 7.5pnpm is a package manager