by Kastro
Paper/Archive/CVE-2025-69264

CVE-2025-69264

pnpm pnpm — pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default"

EPSS 1%public exploitCVSS 9.8
critical.is priorityof 100
52
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 63.1.631 × 2012.6Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

pnpm is a package manager. Versions 10.0.0 through 10.25 allow git-hosted dependencies to execute arbitrary code during pnpm install, circumventing the v10 security feature "Dependency lifecycle scripts execution disabled by default". While pnpm v10 blocks postinstall scripts via the onlyBuiltDependencies mechanism, git dependencies can still execute prepare, prepublish, and prepack scripts during the fetch phase, enabling remote code execution without user consent or approval. This issue is fixed in version 10.26.0.

Affected

ProductAffectedFixed inSource
pnpm> 10.0.0, < 10.26.0–CNA
Red Hat JBoss Enterprise Application Platform 8see advisory–redhat-SADP
Red Hat JBoss Enterprise Application Platform Expansion Packsee advisory–redhat-SADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GitHub_M (CNA)8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
redhat-SADP (CNA)8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

refgithub.com/pnpm/pnpm/security/advisories/GHSA-379q-355j-w6rjrefgithub.com/pnpm/pnpm/commit/73cc63504d9bc360c43e4b2feb9080677f03c5b5refaccess.redhat.com/security/cve/CVE-2025-69264refbugzilla.redhat.com/show_bug.cgi?id=2427709refsecurity.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69264.json