Is CVE-2025-69262 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-69262 being exploited in the wild.

How severe is CVE-2025-69262?

High severity, with a CVSS score of 7.5, published 7 January 2026.

Which products and versions are affected?

pnpm (npm) SEMVER:introduced=6.25.0,fixed=10.27.0.

Is there a fix for CVE-2025-69262?

Yes. pnpm (npm): upgrade to 10.27.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-69262 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2025-69262?

Check whether you run pnpm (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-69262: pnpm command injection via environment variable substitution in tokenHelper

CVE-2025-69262 · Severity: high · CVSS 7.5 · Published 2026-01-07

pnpm is a popular package manager for JavaScript projects. The vulnerability allows remote code execution when environment variables are substituted into .npmrc configuration files with tokenHelper settings. An attacker who can control environment variables in build environments (CI/CD pipelines, Docker builds, Kubernetes) can execute arbitrary code during package installation, potentially compromising build artifacts and deployed applications.

Technologies: pnpm (npm). Vendors: npm.

Quick answers

Is CVE-2025-69262 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-69262 being exploited in the wild.
How severe is CVE-2025-69262?: High severity, with a CVSS score of 7.5, published 7 January 2026.
Which products and versions are affected?: pnpm (npm) SEMVER:introduced=6.25.0,fixed=10.27.0.
Is there a fix for CVE-2025-69262?: Yes. pnpm (npm): upgrade to 10.27.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-69262 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2025-69262?: Check whether you run pnpm (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pnpm (npm): upgrade to 10.27.0 or later
```
npm install pnpm@10.27.0
```

Technical details

The vulnerability exists in pnpm's environment variable substitution mechanism within .npmrc configuration files combined with the tokenHelper functionality. The readLocalConfig() function processes .npmrc files and replaces ${VAR} placeholders with environment variable values without proper validation. The loadToken() function then executes the substituted path using spawnSync() with shell: true, allowing arbitrary command execution. An attacker who can set environment variables (common in CI/CD and containerized environments) and place a malicious script on the filesystem can achieve remote code execution. The affected versions are 6.25.0 through 10.26.x; the patch is available in version 10.27.0, which throws an error if tokenHelper settings contain environment variables.

Affected products

pnpm pnpm >=6.25.0, <10.27.0

Identifiers

CVE-2025-69262
GHSA-2phv-j68v-wwqx

Timeline

2026-01-07: disclosed
2026-01-07: patched: Fixed in pnpm 10.27.0; patch removes shell: true from loadToken and validates substituted paths

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.