Listen to this Post
The vulnerability exploits the interaction between pnpm’s environment variable substitution in `.npmrc` files and the insecure execution of the tokenHelper. When a `.npmrc` file contains a line like registry.npmjs.org/:tokenHelper=${HELPER_PATH}, the value of the `HELPER_PATH` environment variable is substituted into the configuration. The `loadToken()` function in `getAuthHeadersFromConfig.ts` then takes this substituted path and passes it to spawnSync(helperPath, { shell: true }). While the function checks if the path is absolute and exists, it does not validate the content of the path variable. An attacker who controls the `HELPER_PATH` environment variable (e.g., in a CI/CD pipeline) can set it to a command string. Because `shell: true` is enabled, the command is executed by the system shell, leading to arbitrary Remote Code Execution during package installation authentication.
Platform: pnpm
Version: All affected
Vulnerability: Command Injection
Severity: Critical
date: 2025-11-02
Prediction: Undisclosed (No CVE)
What Undercode Say:
`cat > /tmp/evil-helper.sh << 'SCRIPT'`
`export HELPER_PATH=/tmp/evil-helper.sh`
`pnpm install`
`key = envReplace(key, process.env)`
`spawnSync(helperPath, { shell: true })`
How Exploit:
Attacker controls `HELPER_PATH` env var, sets it to a script path. The `.npmrc` substitution inserts this path. The `loadToken()` function executes it with shell: true, granting RCE.
Protection from this CVE:
Remove `shell: true` option.
Validate substituted helper paths.
Use direct `_authToken` in `.npmrc`.
Audit CI/CD environment variables.
Impact:
CVSS 9.1 Critical.
RCE in CI/CD, Docker, K8s builds.
Compromises build and deployment pipelines.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
