CVE-2025-69262

CVE-2025-69262 affects pnpm package manager. Versions 6.25.0 through 10.26.2 are vulnerable to a Command Injection via environment variable substitution in .npmrc when tokenHelper is used, enabling potential Remote Code Execution in build environments. Root cause: the tokenHelper flow allows shel...