PT-2026-1941 · Pnpm · Pnpm

CVE-2025-69264 · Published 2026-01-07 · Updated 2026-06-30

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions pnpm versions 10.0.0 through 10.25

Description pnpm is a package manager affected by an issue where git-hosted dependencies can execute arbitrary code during the pnpm install process. This bypasses the security feature introduced in version 10, which disables dependency lifecycle scripts execution by default. Specifically, while pnpm version 10 blocks postinstall scripts, git dependencies can still execute prepare, prepublish, and prepack scripts during the fetch phase, potentially leading to remote code execution without user consent.

Recommendations Update to pnpm version 10.26.0 or later.

Exploit

Fix

RCE

Protection Mechanism Failure

Weakness Enumeration

CWE-693

Related Identifiers

CVE-2025-69264

GHSA-379Q-355J-W6RJ

Affected Products

Pnpm

References · 17

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69264.json · Exploit
• https://github.com/pnpm/pnpm/commit/73cc63504d9bc360c43e4b2feb9080677f03c5b5 · Patch
• https://github.com/pnpm/pnpm/security/advisories/GHSA-379q-355j-w6rj · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-69264 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-69264 · Security Note
• https://osv.dev/vulnerability/GHSA-379q-355j-w6rj · Vendor Advisory
• https://github.com/pnpm/pnpm · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2427709 · Note
• https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69264.json · Note
• https://access.redhat.com/security/cve/CVE-2025-69264 · Note
• https://t.me/true_secator/7842 · Telegram Post
• https://t.me/cveNotify/148001 · Telegram Post
• https://twitter.com/CCBalert/status/2009628138402177469 · Twitter Post
• https://t.me/cveNotify/179491 · Telegram Post
• https://twitter.com/pulsepatchio/status/2009635207272386598 · Twitter Post