CVE-2025-69262: 
JavaScript vulnerability analysis and mitigation

CVE-2025-69262 is a command injection vulnerability in pnpm, the fast and disk-space-efficient Node.js package manager, affecting versions 6.25.0 through 10.26.2. The flaw exists in the environment variable substitution mechanism used in .npmrc configuration files when the tokenHelper setting is configured. An attacker who can control environment variables during pnpm operations can achieve Remote Code Execution (RCE) in build environments. It was discovered on 2025-11-02 and publicly disclosed on January 7, 2026. The CVSS v3.1 base score is 7.8 (High) per Feedly/NVD, and 7.5–7.6 (High) per the GitHub Advisory (Github Advisory, pnpm Advisory).

The vulnerability is classified as CWE-78 (OS Command Injection) and CWE-94 (Code Injection). The root cause is a two-stage flaw: first, readLocalConfig.ts performs unsanitized ${VAR} environment variable substitution on .npmrc values (including the tokenHelper key) via envReplace(); second, the resolved tokenHelper path is passed to spawnSync(helperPath, { shell: true }) in getAuthHeadersFromConfig.ts's loadToken() function, which only validates that the path is absolute and exists — not that it is trusted or safe. Because shell: true is used, an attacker-controlled environment variable pointing to a malicious script will result in arbitrary OS command execution when pnpm performs authentication against a registry. A public proof-of-concept is included in the advisory (pnpm Advisory, Github Advisory).

Successful exploitation grants an attacker full code execution in the context of the pnpm process, with high impact to confidentiality, integrity, and availability. The highest-risk environments are CI/CD pipelines (GitHub Actions, GitLab CI), Docker build environments, and Kubernetes deployments where environment variables can be influenced by an attacker — for example, through a compromised dependency, a malicious pull request, or control over CI secrets. In such scenarios, an attacker could exfiltrate secrets (e.g., registry tokens, API keys), tamper with build artifacts, or pivot to production deployments via supply chain compromise (pnpm Advisory).

A proof-of-concept exploit is publicly documented in the GitHub Security Advisory, demonstrating the full attack chain from environment variable control to arbitrary code execution (Github Advisory). The EPSS score is approximately 0.041% (13th percentile), indicating a low but non-negligible probability of exploitation in the near term. There is no current evidence of in-the-wild exploitation or threat actor attribution, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires local access and the ability to control environment variables and place a script on the filesystem, which limits opportunistic exploitation but makes it highly relevant in shared CI/CD or containerized build environments.

1. Reconnaissance: Identify build environments (CI/CD pipelines, Docker builds, Kubernetes jobs) using pnpm versions 6.25.0–10.26.2 with private registry authentication configured via .npmrc and tokenHelper.
2. Prepare malicious helper script: Create an executable script at a known filesystem path (e.g., /tmp/evil-helper.sh) that performs the desired malicious action (e.g., exfiltrating secrets, writing a backdoor) and outputs a valid token string to stdout.

   cat > /tmp/evil-helper.sh << 'SCRIPT'
   #!/bin/bash
   echo "RCE SUCCESS!" > /tmp/rce-log.txt
   echo "TOKEN_12345"
   SCRIPT
   chmod +x /tmp/evil-helper.sh

3. Control the environment variable: Set the environment variable that will be substituted into the .npmrc tokenHelper value (e.g., via a CI/CD pipeline secret, a compromised .env file, or a malicious dependency's install script).

   export HELPER_PATH=/tmp/evil-helper.sh

4. Configure .npmrc: Ensure the project's .npmrc references the environment variable in the tokenHelper setting (this may already be present in the target repository).

   registry=https://registry.npmjs.org/
   registry.npmjs.org/:tokenHelper=${HELPER_PATH}

5. Trigger pnpm operation: Run any pnpm command that triggers registry authentication (e.g., pnpm install). During auth header resolution, envReplace() substitutes ${HELPER_PATH} with the attacker-controlled path, and loadToken() executes it via spawnSync(..., { shell: true }).
6. Achieve RCE: The malicious script executes in the build environment, enabling data exfiltration, artifact tampering, or lateral movement to production (pnpm Advisory, Github Advisory).

• File System: Unexpected executable scripts in world-writable directories (e.g., /tmp/*.sh) that output token strings; new or modified .npmrc files containing tokenHelper=${...} referencing environment variables; unexpected files written by build processes (e.g., /tmp/rce-log.txt).
• Process: Unusual child processes spawned by the pnpm/Node.js process (e.g., /bin/bash, sh, or arbitrary scripts) during pnpm install or other pnpm commands; spawnSync calls to paths in /tmp or other non-standard locations.
• Logs: CI/CD build logs showing unexpected script execution or output during pnpm authentication steps; error messages referencing BAD_TOKEN_HELPER_PATH or unexpected token helper paths; environment variable values referencing /tmp or attacker-controlled paths in build logs.
• Network: Unexpected outbound connections from build agents to attacker-controlled infrastructure during or immediately after pnpm install execution (pnpm Advisory).

Upgrade pnpm to version 10.27.0 or later, which throws an error if the tokenHelper or :tokenHelper setting contains an environment variable, preventing the substitution-to-execution chain (pnpm Release). As an immediate workaround, disable tokenHelper in .npmrc and use direct static token authentication instead (//registry.npmjs.org/:_authToken=YOUR_TOKEN). Additionally, audit all CI/CD environment variables for unexpected values, restrict who can modify .npmrc files in repositories, and review build logs for anomalous script execution. IBM API Connect users should consult the IBM advisories for affected product versions (IBM Advisory 1, IBM Advisory 2).

The vulnerability was reported by security researcher Jiyong Yang (sy2n0@naver.com) and disclosed by pnpm maintainer Zoltan Kochan (zkochan) on January 7, 2026 (pnpm Advisory). The Hacker Wire covered the disclosure on social media platforms including Mastodon and Bluesky shortly after publication. IBM subsequently issued advisories for affected IBM API Connect products in May 2026 (IBM Advisory 1). Community reaction was moderate, with the fix noted as straightforward — throwing an error on environment variable usage in tokenHelper — and the advisory highlighting the supply chain risk in CI/CD environments.