CVE-2025-69262 Overview
CVE-2025-69262 is a command injection vulnerability in pnpm, a JavaScript package manager. The flaw exists in versions 6.25.0 through 10.26.2 and stems from unsafe environment variable substitution in .npmrc configuration files that reference the tokenHelper setting. An attacker who controls environment variables during pnpm operations can achieve remote code execution in build environments. The issue is fixed in version 10.27.0. The vulnerability is tracked under CWE-78: Improper Neutralization of Special Elements used in an OS Command.
Critical Impact
Attackers who can influence environment variables during a pnpm install or related operation can execute arbitrary OS commands in CI/CD build environments, leading to supply chain compromise.
Affected Products
- pnpm versions 6.25.0 through 10.26.2
- Node.js build environments and CI/CD pipelines using vulnerable pnpm releases
- Projects consuming .npmrc files that configure tokenHelper
Discovery Timeline
- 2026-01-07 - CVE-2025-69262 published to NVD
- 2026-06-22 - Last updated in NVD database
Technical Details for CVE-2025-69262
Vulnerability Analysis
The vulnerability resides in how pnpm processes the tokenHelper directive in .npmrc configuration files. The tokenHelper option is designed to execute an external program that returns an authentication token for private registries. Pnpm performs environment variable substitution on the configured value before executing it, without sufficient neutralization of shell metacharacters.
When an attacker controls the contents of an environment variable that gets substituted into the tokenHelper command string, the injected value can break out of the intended argument boundary and introduce additional shell commands. Because pnpm operations frequently run inside continuous integration systems with elevated permissions and access to source code, secrets, and package registries, successful exploitation extends beyond the immediate host.
Root Cause
The root cause is improper neutralization of special elements passed to an OS command [CWE-78]. Pnpm expands environment variables within tokenHelper configuration values and passes the resulting string to the operating system without validating that the substituted content constitutes a safe command invocation.
Attack Vector
Exploitation requires local access with the ability to influence environment variables consumed by pnpm. Typical attack scenarios include a malicious dependency contributor supplying a repository whose .npmrc references attacker-influenced environment variables, or an attacker with limited access to a shared CI runner setting variables read by a later pnpm invocation. The vulnerability requires low privileges and no user interaction, resulting in high impact to confidentiality, integrity, and availability.
No public proof-of-concept exploit has been published. Refer to the GitHub Security Advisory GHSA-2phv-j68v-wwqx for authoritative technical details.
Detection Methods for CVE-2025-69262
Indicators of Compromise
- Unexpected child processes spawned by the pnpm binary during install, fetch, or publish operations
- .npmrc files containing a tokenHelper directive with embedded environment variable references such as ${VAR}
- Outbound network connections from CI/CD build agents to unrecognized hosts immediately following pnpm invocations
- Modification of environment variables in build pipelines that precede pnpm execution
Detection Strategies
- Scan source repositories and build images for .npmrc files that set tokenHelper and inventory the environment variables referenced
- Audit pnpm versions across developer workstations and CI runners; flag any installation between 6.25.0 and 10.26.2
- Monitor process ancestry on build hosts for shell interpreters or unusual binaries launched as children of pnpm or node
Monitoring Recommendations
- Enable command-line logging on CI/CD runners and forward events to a centralized analytics platform
- Alert on writes to .npmrc files outside expected developer commits or during pipeline execution
- Track pnpm version telemetry across the build fleet and enforce a minimum version of 10.27.0
How to Mitigate CVE-2025-69262
Immediate Actions Required
- Upgrade pnpm to version 10.27.0 or later on all developer workstations, container images, and CI/CD runners
- Inventory all .npmrc files in code repositories and identify uses of tokenHelper that reference environment variables
- Rotate any registry authentication tokens that may have been exposed in build environments running vulnerable pnpm versions
- Restrict who can set environment variables on shared CI/CD infrastructure
Patch Information
The pnpm maintainers released the fix in pnpm v10.27.0. Full advisory details are published in GitHub Security Advisory GHSA-2phv-j68v-wwqx.
Workarounds
- Remove tokenHelper entries from .npmrc files where alternative authentication methods are viable
- Replace environment variable substitutions inside tokenHelper with static, controlled paths to trusted helper binaries
- Execute pnpm in ephemeral, single-tenant build environments to limit exposure to attacker-controlled variables
# Configuration example: upgrade pnpm and verify installed version
npm install -g pnpm@10.27.0
pnpm --version
# Audit repositories for vulnerable tokenHelper usage
grep -RIn "tokenHelper" . --include=".npmrc"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
