CVE-2025-69264: pnpm v10+ Git Dependency Script Execution Bypass Vulnerability
Summary
CVE-2025-69264: pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default". Affects pnpm versions >= 10.0.0, < 10.26.0. Fixed in 10.26.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pnpm is a fast, disk space-efficient package manager for JavaScript and Node.js applications. It is designed to optimize the installation of packages by using a content-addressable filesystem to save disk space and speed up installations. However, in versions 10 and above, pnpm introduced a security feature that disables the execution of dependency lifecycle scripts by default. This vulnerability allows git-hosted dependencies to bypass this security measure and execute arbitrary code during installation.
Vulnerability Detail
A security bypass vulnerability in pnpm v10+ allows git-hosted dependencies to execute arbitrary code during 'pnpm install', circumventing the v10 security feature that disables dependency lifecycle scripts by default. While pnpm v10 blocks 'postinstall' scripts, git dependencies can still execute 'prepare', 'prepublish', and 'prepack' scripts during the fetch phase, leading to potential remote code execution without user consent. This vulnerability affects all pnpm v10+ users, including CI/CD pipelines, and can lead to severe consequences such as unauthorized code execution, data exfiltration, and system compromise.
How To Fix
Minimum fixed version
10.26.0
This is the first release that contains the fix.
npm install pnpm@10.26.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can set the 'ignore-scripts' option to true when running 'pnpm install'. This can be done by executing the following command: 'pnpm install --ignore-scripts'. However, this may prevent legitimate scripts from running, so use it with caution.
Conclusion
The pnpm v10+ Git Dependency Script Execution Bypass vulnerability (CVE-2025-69264) poses a significant risk to users by allowing malicious git-hosted dependencies to execute arbitrary code during installation. It is crucial for users to update to the patched version of pnpm and consider workarounds to mitigate risks until they can upgrade.
See every vulnerability recorded for pnpm →
FAQ
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
All users of pnpm v10 and above are affected, particularly those who use git-hosted dependencies.
The affected scripts include 'prepare', 'prepublish', and 'prepack' scripts that can execute during the fetch phase.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup at Vulert Scanner.
The consequences include unauthorized code execution, data exfiltration, modification of source code, and potential system compromise.
References
Related vulnerabilities
Recent vulnerabilities recorded for pnpm.
