A command injection vulnerability (CVE-2025-69262) exists in pnpm version 9.15.4 and later when using environment variable substitution in .npmrc files with tokenHelper settings. An attacker controlling environment variables can execute arbitrary code during pnpm operations, particularly in build environments such as CI/CD pipelines, Docker builds, and Kubernetes deployments. The vulnerability arises from spawning a helper script with shell execution without sufficient validation. The CVSS score is 7.5 (High).