CVE-2025-69262

Red Hat statement

This vulnerability is rated Moderate for Red Hat. The flaw in pnpm allows for remote code execution via command injection when environment variable substitution is used in `.npmrc` files with `tokenHelper` settings. Exploitation requires an attacker to control environment variables and place malicious scripts, primarily impacting build environments such as CI/CD pipelines or Docker builds. Red Hat products like Enterprise Application Platform are not directly affected by this pnpm vulnerability.

Red Hat mitigation

To reduce exposure, avoid using the tokenHelper setting in .npmrc configuration files. Instead, configure authentication using direct tokens. It is also recommended to audit and restrict environment variables in build environments, including CI/CD pipelines and container build processes, to prevent unauthorized control.