CVE-2025-69262
1 advisory.
npm/pnpm CVE-2025-69262: high 7.5, EPSS 1.04%
pnpm vulnerable to Command Injection via environment variable substitution
Action: Upgrade pnpm to 10.27.0 or later.
npm i pnpm@10.27.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 6.25.0 | 10.27.0 | - |
Fixed versions
| 10.27.0 |
Sources
- osv: GHSA-2phv-j68v-wwqx
- https://github.com/pnpm/pnpm/security/advisories/GHSA-2phv-j68v-wwqx
- https://nvd.nist.gov/vuln/detail/CVE-2025-69262
- https://github.com/pnpm/pnpm
- https://github.com/pnpm/pnpm/releases/tag/v10.27.0
CVE-2025-69262 · published · modified · JSON