What is the CVSS score of CVE-2025-69262?

CVE-2025-69262 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Node.js are affected by CVE-2025-69262?

Organizations using pnpm face notable risk from CVE-2025-69262, a OS command injection vulnerability rated CVSS 7.5.. A patch is available.

Is there a public PoC exploit available for CVE-2025-69262?

Yes, a public proof-of-concept exploit is available for CVE-2025-69262. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2025-69262?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Validate that input sanitization is in place for all user-controlled parameters.

Node.js CVE-2025-69262

HIGH

OS Command Injection (CWE-78)

2026-01-07 security-advisories@github.com

GHSA-2phv-j68v-wwqx

Node.js RCE Command Injection Pnpm Red Hat

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Red Hat

7.5 MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Jan 12, 2026 - 21:50 vuln.today

Public exploit code

CVE Published

Jan 07, 2026 - 23:15 nvd

HIGH 7.5

DescriptionGitHub Advisory

pnpm is a package manager. Versions 6.25.0 through 10.26.2 have a Command Injection vulnerability when using environment variable substitution in .npmrc configuration files with tokenHelper settings. An attacker who can control environment variables during pnpm operations could achieve Remote Code Execution (RCE) in build environments. This issue is fixed in version 10.27.0.

AnalysisAI

Technical ContextAI

Classified as CWE-78 (OS Command Injection). Affects Pnpm. pnpm is a package manager. Versions 6.25.0 through 10.26.2 have a Command Injection vulnerability when using environment variable substitution in .npmrc configuration files with tokenHelper settings. An attacker who can control environment variables during pnpm operations could achieve Remote Code Execution (RCE) in build environments. This issue is fixed in version 10.27.0.