CVE-2025-69264 - CVE House
Back to Database
Status published High CVE-2025-69264

pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default"

Vulnerability Description

pnpm is a package manager. Versions 10.0.0 through 10.25 allow git-hosted dependencies to execute arbitrary code during pnpm install, circumventing the v10 security feature "Dependency lifecycle scripts execution disabled by default". While pnpm v10 blocks postinstall scripts via the onlyBuiltDependencies mechanism, git dependencies can still execute prepare, prepublish, and prepack scripts during the fetch phase, enabling remote code execution without user consent or approval. This issue is fixed in version 10.26.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-69264

Credits & Attribution

No credits recorded in the NVD database.

References

More from pnpm

View All →
CVE-2025-69263
pnpm Lockfile Integrity Bypass Allows Remote Dynamic Dependencies
High 7.5
CVE-2025-69262
pnpm vulnerable to Command Injection via environment variable substitution
High 7.6
CVE-2024-53866
pnpm vulnerable to no-script global cache poisoning via overrides / `ignore-scripts` evasion
Medium 5.8
CVE-2024-47829
pnpm uses the md5 path shortening function causes packet paths to coincide, which causes indirect packet overwriting
Medium 6.5
CVE-2023-37478
pnpm incorrectly parses tar archives relative to specification
High 7.5

Affected Vendor

Affected Software

pnpm
Vulnerable Versions:
> 10.0.0, < 10.26.0

Timeline

Official Publish: January 7th, 2026
Last Modified: July 15th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-693

MITRE ATT&CK TTPs

T1562 Impair Defenses
Defense Evasion
T1190 Exploit Public-Facing Application
Initial Access
T1068 Exploitation for Privilege Escalation
Privilege Escalation
T1550 Use Alternate Authentication Material
Defense Evasion
T1485 Data Destruction
Impact