A high-severity command injection vulnerability in pnpm could allow an attacker with high privileges to achieve remote code execution in build environments.

This flaw involves improper neutralization of special elements used in OS commands (CWE-78) and improper control of code generation (CWE-94) when using environment variable substitution in .npmrc files. The vulnerability requires high privileges (PR:H) to influence the environment variables during pnpm operations.

Successful exploitation allows an attacker to execute arbitrary commands within the build environment, potentially leading to full system compromise, data theft, or the injection of malicious code into software artifacts. With a CVSS score of 7.5, this vulnerability represents a significant risk to the integrity of the software supply chain. Organizations relying on pnpm in automated CI/CD pipelines are at particular risk of unauthorized pipeline manipulation.

Immediate Action: Update pnpm to version 10.27.0 or later immediately to incorporate the necessary security patches.

Proactive Monitoring: Monitor build logs and process execution history for unexpected shell commands or unauthorized modifications to .npmrc files.

Compensating Controls: Restrict access to build environment configurations and ensure that environment variables are strictly sanitized before being passed to package management processes.

Public Exploit Available: Unknown

Given the potential for remote code execution and the presence of a proof-of-concept, administrators must prioritize updating their pnpm instances to version 10.27.0. Security teams should audit their CI/CD configurations to ensure that environment variable handling follows least-privilege principles to mitigate the impact of similar vulnerabilities.