Executive brief
pnpm is a popular package manager for JavaScript projects. The vulnerability allows remote code execution when environment variables are substituted into .npmrc configuration files with tokenHelper settings. An attacker who can control environment variables in build environments (CI/CD pipelines, Docker builds, Kubernetes) can execute arbitrary code during package installation, potentially compromising build artifacts and deployed applications.
Technical details
The vulnerability exists in pnpm's environment variable substitution mechanism within .npmrc configuration files combined with the tokenHelper functionality. The readLocalConfig() function processes .npmrc files and replaces ${VAR} placeholders with environment variable values without proper validation. The loadToken() function then executes the substituted path using spawnSync() with shell: true, allowing arbitrary command execution. An attacker who can set environment variables (common in CI/CD and containerized environments) and place a malicious script on the filesystem can achieve remote code execution. The affected versions are 6.25.0 through 10.26.x; the patch is available in version 10.27.0, which throws an error if tokenHelper settings contain environment variables.
Affected products
- pnpm pnpm >=6.25.0, <10.27.0
Timeline
- 2026-01-07: disclosed
- 2026-01-07: patched: Fixed in pnpm 10.27.0; patch removes shell: true from loadToken and validates substituted paths