CVE-2025-69264
📋 TL;DR
This vulnerability in pnpm package manager versions 10.0.0 through 10.25 allows git-hosted dependencies to execute arbitrary code during installation. It bypasses pnpm v10's security feature that disables dependency lifecycle scripts by default, enabling remote code execution without user consent. Anyone using affected pnpm versions with git dependencies is vulnerable.
💻 Affected Systems
- pnpm
📦 What is this software?
Pnpm by Pnpm
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through arbitrary code execution during package installation, potentially leading to data theft, ransomware deployment, or persistent backdoors.
Likely Case
Malicious packages exploiting this vulnerability could steal credentials, install cryptocurrency miners, or exfiltrate sensitive project data during CI/CD pipelines.
If Mitigated
With proper network segmentation and least privilege, impact could be limited to the build environment without affecting production systems.
🎯 Exploit Status
Exploitation requires only installing a malicious git dependency, making it trivial for attackers who control git repositories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 10.26.0
Vendor Advisory: https://github.com/pnpm/pnpm/security/advisories/GHSA-379q-355j-w6rj
Restart Required: No
Instructions:
1. Update pnpm globally: npm install -g pnpm@10.26.0
2. Update pnpm in project: pnpm add -g pnpm@10.26.0
3. Verify update with: pnpm --version
🔧 Temporary Workarounds
Avoid git dependencies
allTemporarily avoid using git-hosted dependencies until patched
Replace git:// URLs with published npm package versions
Use onlyBuiltDependencies
allExplicitly configure onlyBuiltDependencies to block all lifecycle scripts
Add to .npmrc: only-built-dependencies=*
🧯 If You Can't Patch
- Audit all git dependencies for suspicious repositories and maintainers
- Implement network restrictions to prevent outbound connections from build environments
🔍 How to Verify
Check if Vulnerable:
Check pnpm version: pnpm --version. If version is between 10.0.0 and 10.25 inclusive, you are vulnerable if using git dependencies.Check Version:
pnpm --versionVerify Fix Applied:
Verify pnpm version is 10.26.0 or higher: pnpm --version📡 Detection & Monitoring
Log Indicators:
- Unexpected process execution during pnpm install
- Network connections from pnpm to unknown git repositories
- prepare/prepublish/prepack script execution in build logs
Network Indicators:
- Outbound connections to suspicious git repositories during package installation
SIEM Query:
process.name:pnpm AND (process.args:*install* OR process.args:*add*) AND process.args:*git*