Remote Code Execution via Git Dependencies in pnpm

Publication date: 2026-01-07

Last updated on: 2026-06-30

Assigner: GitHub, Inc.

Description

pnpm is a package manager. Versions 10.0.0 through 10.25 allow git-hosted dependencies to execute arbitrary code during pnpm install, circumventing the v10 security feature "Dependency lifecycle scripts execution disabled by default". While pnpm v10 blocks postinstall scripts via the onlyBuiltDependencies mechanism, git dependencies can still execute prepare, prepublish, and prepack scripts during the fetch phase, enabling remote code execution without user consent or approval. This issue is fixed in version 10.26.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-07

Last Modified

2026-06-30

Generated

2026-07-06

AI Q&A

2026-01-08

EPSS Evaluated

2026-07-05

NVD

CVE-2025-69264

Affected Vendors & Products

Vendor	Product	Version / Range
pnpm	pnpm	to 10.26.0 (exc)
pnpm	pnpm	10.26.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-693	The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

Executive Summary

This vulnerability in pnpm versions 10.0.0 through 10.25 allows git-hosted dependencies to execute arbitrary code during the pnpm install process. Although pnpm v10 disables dependency lifecycle scripts by default, git dependencies can still run prepare, prepublish, and prepack scripts during the fetch phase. This enables remote code execution without the user's consent or approval. The issue is fixed in version 10.26.0.

Impact Analysis

The vulnerability can lead to remote code execution on your system during the installation of git-hosted dependencies with pnpm. This means an attacker could run arbitrary code without your consent, potentially compromising system integrity, confidentiality, and availability.

Mitigation Strategies

Upgrade pnpm to version 10.26.0 or later, as this version contains the fix for the vulnerability that allows arbitrary code execution via git-hosted dependencies during installation.

Hi! I’m here to help you understand CVE-2025-69264. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70