High · published January 8, 2026
⚡ An environment variable is all an attacker needs for Remote Code Execution in pnpm! 🔥 Think of your .npmrc file as a recipe where a sneaky chef adds their own ingredients in the middle of cooking — if they control those ingredients, they can completely change the dish. In this case, the dish is your build environment, and it could end with malicious code running unchecked. An attacker could exploit this vulnerability during pnpm operations, allowing them to run arbitrary code in your build environment. This could lead to compromised systems, data breaches, or even full access to your infrastructure, which is absolutely devastating!
Think of your .npmrc file as a recipe where a sneaky chef adds their own ingredients in the middle of cooking — if they control those ingredients, they can completely change the dish. In this case, the dish is your build environment, and it could end with malicious code running unchecked. The command injection vulnerability arises from improper handling of environment variable substitutions in the .npmrc configuration files, specifically when using tokenHelper settings. This flaw can allow attackers to inject malicious commands during pnpm operations, triggering Remote Code Execution.
An attacker could exploit this vulnerability during pnpm operations, allowing them to run arbitrary code in your build environment. This could lead to compromised systems, data breaches, or even full access to your infrastructure, which is absolutely devastating! Immediately update pnpm to version 10.27.0 to close this vulnerability. Review your .npmrc configurations to ensure no dangerous variables are present, and consider implementing strict access controls to manage environment variable settings. You've got this! With these steps, you can secure your environment and protect your builds like a true security hero! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| pnpm/pnpm | ≥ 6.25.0, < 10.27.0 | 10.27.0 |