Packages / pnpm / Security

HighVulnerabilityGHSA-2phv-j68v-wwqxPublished 7 Jan 2026

pnpm vulnerable to Command Injection via environment variable substitution

Affected · pnpm

  • >= 6.25.0, < 10.27.0

Fixed in

10.27.0

npm install pnpm@10.27.0

  1. Not affected

    0.0.1 – 6.24.4

    622 releases

  2. Affected

    6.25.0 – 10.26.2

    296 releases

  3. Fixed

    10.27.0 – 12.14.0

    112 releases, latest

1030 stable releases of pnpm, oldest to newest.

What happens

The full text is not stored yet. Read it on osv.dev.