Summary
pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default"
Full technical description
pnpm v10+ Git Dependency Script Execution Bypass
A security bypass vulnerability in pnpm v10+ allows git-hosted dependencies to execute arbitrary code during pnpm install, circumventing the v10 security feature "Dependency lifecycle scripts execution disabled by default". While pnpm v10 blocks postinstall scripts via the onlyBuiltDependencies mechanism, git dependencies can still execute prepare, prepublish, and prepack scripts during the fetch phase, enabling remote code execution without user consent or approval.
Details
pnpm v10 introduced a security feature to disable dependency lifecycle scripts by default (PR #8897). This is implemented by setting onlyBuiltDependencies = [] when no build policy is configured:
File: pkg-manager/core/src/install/extendInstallOptions.ts (lines 290-291)
if (opts.neverBuiltDependencies == null && opts.onlyBuiltDependencies == null && opts.onlyBuiltDependenciesFile == null) {
opts.onlyBuiltDependencies = []
}
This creates an allowlist that blocks all packages from running scripts during the BUILD phase in exec/build-modules/src/index.ts.
However, git-hosted dependencies are processed differently. During the FETCH phase, git packages are prepared using preparePackage():
File: exec/prepare-package/src/index.ts (lines 28-57)
export async function preparePackage (opts: PreparePackageOptions, gitRootDir: string, subDir: string) {
// ...
if (opts.ignoreScripts) return { shouldBeBuilt: true, pkgDir } // Only checks ignoreScripts, not onlyBuiltDependencies
const execOpts: RunLifecycleHookOptions = {
// ...
rawConfig: omit(['ignore-scripts'], opts.rawConfig), // Explicitly removes ignore-scripts!
}
// Runs npm/pnpm install
await runLifecycleHook(installScriptName, manifest, execOpts)
// Runs prepare scripts
for (const scriptName of PREPUBLISH_SCRIPTS) { // ['prepublish', 'prepack', 'publish']
await runLifecycleHook(newScriptName, manifest, execOpts)
}
}
The ignoreScripts option defaults to false and is completely separate from onlyBuiltDependencies. The onlyBuiltDependencies allowlist is never consulted during the fetch phase.
Affected scripts that execute during fetch:
prepareprepublishprepack
Attack vectors:
git+https://github.com/attacker/malicious.gitgithub:attacker/maliciousgitlab:attacker/maliciousbitbucket:attacker/maliciousgit+ssh://[email protected]/attacker/malicious.gitgit+file:///path/to/local/repo
PoC
Prerequisites:
- pnpm v10.0.0 or later (tested on v10.23.0 and v11.0.0-alpha.1)
- git
Steps to reproduce:
Extract the attached poc.zip
Run the PoC script:
cd poc chmod +x run-poc.sh ./run-poc.shVerify the marker file was created by the malicious script:
cat /tmp/pnpm-vuln-poc-marker.txt
Manual reproduction:
Create a malicious package with a
preparescript:{ "name": "malicious-pkg", "version": "1.0.0", "scripts": { "prepare": "node -e \"require('fs').writeFileSync('/tmp/pwned.txt', 'RCE!')\"" } }Initialize it as a git repo and commit the files
Create a victim project that depends on it (just have to make sure it actually git clones and not just downloads a tarball):
{ "dependencies": { "malicious-pkg": "git+file:///path/to/malicious-pkg" } }Run
pnpm install- the prepare script executes without any warning or approval prompt
Impact
Severity: High
Who is impacted:
- All pnpm v10+ users
- Users who believed they were protected by the v10 "scripts disabled by default" feature
- CI/CD pipelines
Attack scenarios:
- Supply chain attack: An attacker compromises a dependency, adding to it a malicious git dependency that executes arbitrary code during
pnpm install
What an attacker can do:
- Execute arbitrary code with the victim's privileges
- Exfiltrate environment variables, secrets, and credentials
- Modify source code or inject backdoors
- Establish persistence or reverse shells
- Access the filesystem and network
Why this bypasses security expectations:
- pnpm v10 changelog explicitly states "Lifecycle scripts of dependencies are not executed during installation by default"
- Users expect git dependencies to follow the same security model as npm registry packages
- There is no warning that git dependencies are treated differently
- The
onlyBuiltDependenciesconfiguration does not affect git dependencies
CVE-2025-69264 has a CVSS score of 8.8 (High). The vector is network-reachable, no privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (10.26.0); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Kodem Kai can prioritize this vulnerability in your dependency tree and generate a fix recommendation.
Frequently Asked Questions
- What is CVE-2025-69264? CVE-2025-69264 is a high-severity security vulnerability in pnpm (npm), affecting versions >= 10.0.0, < 10.26.0. It is fixed in 10.26.0.
- How severe is CVE-2025-69264? CVE-2025-69264 has a CVSS score of 8.8 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of pnpm are affected by CVE-2025-69264? pnpm (npm) versions >= 10.0.0, < 10.26.0 is affected.
- Is there a fix for CVE-2025-69264? Yes. CVE-2025-69264 is fixed in 10.26.0. Upgrade to this version or later.
- Is CVE-2025-69264 exploitable, and should I be worried? Whether CVE-2025-69264 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2025-69264 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2025-69264? Upgrade
pnpmto 10.26.0 or later.