CVE-2025-69264
Unknown Unknown - Not Provided
Remote Code Execution via Git Dependencies in pnpm

Publication date: 2026-01-07

Last updated on: 2026-01-07

Assigner: GitHub, Inc.

Description
pnpm is a package manager. Versions 10.0.0 through 10.25 allow git-hosted dependencies to execute arbitrary code during pnpm install, circumventing the v10 security feature "Dependency lifecycle scripts execution disabled by default". While pnpm v10 blocks postinstall scripts via the onlyBuiltDependencies mechanism, git dependencies can still execute prepare, prepublish, and prepack scripts during the fetch phase, enabling remote code execution without user consent or approval. This issue is fixed in version 10.26.0.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-01-07
Last Modified
2026-01-07
Generated
2026-06-16
AI Q&A
2026-01-08
EPSS Evaluated
2026-06-14
NVD
CVE-2025-69264
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
pnpm pnpm to 10.26.0 (exc)
pnpm pnpm 10.26.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-693 The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability in pnpm versions 10.0.0 through 10.25 allows git-hosted dependencies to execute arbitrary code during the pnpm install process. Although pnpm v10 disables dependency lifecycle scripts by default, git dependencies can still run prepare, prepublish, and prepack scripts during the fetch phase. This enables remote code execution without the user's consent or approval. The issue is fixed in version 10.26.0.

Impact Analysis

The vulnerability can lead to remote code execution on your system during the installation of git-hosted dependencies with pnpm. This means an attacker could run arbitrary code without your consent, potentially compromising system integrity, confidentiality, and availability.

Mitigation Strategies

Upgrade pnpm to version 10.26.0 or later, as this version contains the fix for the vulnerability that allows arbitrary code execution via git-hosted dependencies during installation.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-69264. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart