CVE-2025-69262 | Teknoloji dünyasından en güncel haberleri ve güvenlikle ilgili gelişmeleri takip edin.

pnpm is a package manager. Versions 6.25.0 through 10.26.2 have a Command Injection vulnerability when using environment variable substitution in .npmrc configu…
High CVSS: 7.5

CVE-2025-69262

pnpm is a package manager. Versions 6.25.0 through 10.26.2 have a Command Injection vulnerability when using environment variable substitution in .npmrc configuration files with tokenHelper settings. An attacker who can control environment variables during pnpm operations could achieve Remote Code Execution (RCE) in build environments. This issue is fixed in version 10.27.0.
Vendor
Pnpm
Product
Pnpm
CWE
CWE-78
Yayın Tarihi
2026-01-07 23:15:50
Güncelleme
2026-01-12 21:50:45
Source Identifier
security-advisories@github.com
KEV Date Added
-

Kategoriler

CWE-78 Pnpm HIGH Pnpm 2026

Referanslar

https://github.com/pnpm/pnpm/releases/tag/v10.27.0 https://github.com/pnpm/pnpm/security/advisories/GHSA-2phv-j68v-wwqx https://github.com/pnpm/pnpm/security/advisories/GHSA-2phv-j68v-wwqx