diff --git a/packages/core/cli/package.json b/packages/core/cli/package.json
index dace07c0a..82fdc0f11 100644
--- a/packages/core/cli/package.json
+++ b/packages/core/cli/package.json
@@ -13,7 +13,7 @@
     "@umijs/utils": "3.5.20",
     "chalk": "^4.1.1",
     "commander": "^9.2.0",
-    "dotenv": "^10.0.0",
+    "dotenv": "^16.0.0",
     "execa": "^5.1.1",
     "fast-glob": "^3.3.1",
     "fs-extra": "^11.1.1",
diff --git a/yarn.lock b/yarn.lock
index 57fed3595..4045511b3 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -11948,10 +11948,10 @@ dot-prop@^6.0.1:
   dependencies:
     is-obj "^2.0.0"
 
-dotenv@^10.0.0:
-  version "10.0.0"
-  resolved "https://registry.npmmirror.com/dotenv/-/dotenv-10.0.0.tgz#3d4227b8fb95f81096cdd2b66653fb2c7085ba81"
-  integrity sha512-rlBi9d8jpv9Sf1klPjNfFAuWDjKLwTIJJ/VxtoTwIR6hnZxcEOQCZg2oIL3MWBYw5GpUDKOEnND7LXTbIpQ03Q==
+dotenv@^16.0.0:
+  version "16.4.5"
+  resolved "https://registry.npmmirror.com/dotenv/-/dotenv-16.4.5.tgz#cdd3b3b604cb327e286b4762e13502f717cb099f"
+  integrity sha512-ZmdL2rui+eB2YwhsWzjInR8LldtZHGDoQ1ugH85ppHKwpUHL7j7rN0Ti9NCnGiQbhaZ11FpR+7ao1dNsmduNUg==
 
 dotignore@~0.1.2:
   version "0.1.2"