pnpm is a package manager. Versions 6.25.0 through 10.26.2 have a Command Injection vulnerability when using environment variable substitution in .npmrc configuration files with tokenHelper settings. An attacker who can control environment variables during pnpm operations could achieve Remote Code Execution (RCE) in build environments. This issue is fixed in version 10.27.0.
Fix
Patch, vendor advisory and mitigation references on NVD 2
- https://github.com/pnpm/pnpm/security/advisories/GHSA-2phv-j68v-wwqx Exploit, Vendor Advisory
- https://github.com/pnpm/pnpm/security/advisories/GHSA-2phv-j68v-wwqx Exploit, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 7.8 · pnpmNVD modified 2026-10-14 19:10
Affected (CPE criteria) 1
cpe:2.3:a:pnpm:pnpm:*:*:*:*:*:node.js:*:*
References 3
- https://github.com/pnpm/pnpm/releases/tag/v10.27.0 Product, Release Notes
- https://github.com/pnpm/pnpm/security/advisories/GHSA-2phv-j68v-wwqx Exploit, Vendor Advisory
- https://github.com/pnpm/pnpm/security/advisories/GHSA-2phv-j68v-wwqx Exploit, Vendor Advisory