CVE-2025-69264: Pnpm Pnpm V10+ Bypass "Dependency Lifecycle Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-379q-355j-w6rj",
  "modified" : "2026-01-08T20:05:37Z",
  "published" : "2026-01-07T19:07:43Z",
  "aliases" : [ "CVE-2025-69264" ],
  "summary" : "pnpm v10+ Bypass \"Dependency lifecycle scripts execution disabled by default\"",
  "details" : "# pnpm v10+ Git Dependency Script Execution Bypass\n\n### Summary\n\nA security bypass vulnerability in pnpm v10+ allows git-hosted dependencies to execute arbitrary code during `pnpm install`, circumventing the v10 security feature \"Dependency lifecycle scripts execution disabled by default\". While pnpm v10 blocks `postinstall` scripts via the `onlyBuiltDependencies` mechanism, git dependencies can still execute `prepare`, `prepublish`, and `prepack` scripts during the fetch phase, enabling remote code execution without user consent or approval.\n\n### Details\n\npnpm v10 introduced a security feature to disable dependency lifecycle scripts by default ([PR #8897](https://github.com/pnpm/pnpm/pull/8897)). This is implemented by setting `onlyBuiltDependencies = []` when no build policy is configured:\n\n**File:** `pkg-manager/core/src/install/extendInstallOptions.ts` (lines 290-291)\n```typescript\nif (opts.neverBuiltDependencies == null && opts.onlyBuiltDependencies == null && opts.onlyBuiltDependenciesFile == null) {\n  opts.onlyBuiltDependencies = []\n}\n```\n\nThis creates an allowlist that blocks all packages from running scripts during the **BUILD phase** in `exec/build-modules/src/index.ts`.\n\nHowever, git-hosted dependencies are processed differently. During the **FETCH phase**, git packages are prepared using `preparePackage()`:\n\n**File:** `exec/prepare-package/src/index.ts` (lines 28-57)\n```typescript\nexport async function preparePackage (opts: PreparePackageOptions, gitRootDir: string, subDir: string) {\n  // ...\n  if (opts.ignoreScripts) return { shouldBeBuilt: true, pkgDir }  // Only checks ignoreScripts, not onlyBuiltDependencies\n\n  const execOpts: RunLifecycleHookOptions = {\n    // ...\n    rawConfig: omit(['ignore-scripts'], opts.rawConfig),  // Explicitly removes ignore-scripts!\n  }\n\n  // Runs npm/pnpm install\n  await runLifecycleHook(installScriptName, manifest, execOpts)\n\n  // Runs prepare scripts\n  for (const scriptName of PREPUBLISH_SCRIPTS) {  // ['prepublish', 'prepack', 'publish']\n    await runLifecycleHook(newScriptName, manifest, execOpts)\n  }\n}\n```\n\nThe `ignoreScripts` option defaults to `false` and is completely separate from `onlyBuiltDependencies`. The `onlyBuiltDependencies` allowlist is never consulted during the fetch phase.\n\n**Affected scripts that execute during fetch:**\n- `prepare`\n- `prepublish`\n- `prepack`\n\n**Attack vectors:**\n- `git+https://github.com/attacker/malicious.git`\n- `github:attacker/malicious`\n- `gitlab:attacker/malicious`\n- `bitbucket:attacker/malicious`\n- `git+ssh://git@github.com/attacker/malicious.git`\n- `git+file:///path/to/local/repo`\n\n### PoC\n\n**Prerequisites:**\n- pnpm v10.0.0 or later (tested on v10.23.0 and v11.0.0-alpha.1)\n- git\n\n**Steps to reproduce:**\n\n1. Extract the attached [poc.zip](https://github.com/user-attachments/files/23797816/poc.zip)\n\n2. Run the PoC script:\n   ```bash\n   cd poc\n   chmod +x run-poc.sh\n   ./run-poc.sh\n   ```\n\n3. Verify the marker file was created by the malicious script:\n   ```bash\n   cat /tmp/pnpm-vuln-poc-marker.txt\n   ```\n\n**Manual reproduction:**\n\n1. Create a malicious package with a `prepare` script:\n   ```json\n   {\n     \"name\": \"malicious-pkg\",\n     \"version\": \"1.0.0\",\n     \"scripts\": {\n       \"prepare\": \"node -e \\\"require('fs').writeFileSync('/tmp/pwned.txt', 'RCE!')\\\"\"\n     }\n   }\n   ```\n\n2. Initialize it as a git repo and commit the files\n\n3. Create a victim project that depends on it (just have to make sure it actually git clones and not just downloads a tarball):\n   ```json\n   {\n     \"dependencies\": {\n       \"malicious-pkg\": \"git+file:///path/to/malicious-pkg\"\n     }\n   }\n   ```\n\n4. Run `pnpm install` - the prepare script executes without any warning or approval prompt\n\n### Impact\n\n**Severity: High**\n\n**Who is impacted:**\n- All pnpm v10+ users\n- Users who believed they were protected by the v10 \"scripts disabled by default\" feature\n- CI/CD pipelines\n\n**Attack scenarios:**\n1. **Supply chain attack:** An attacker compromises a dependency, adding to it a malicious git dependency that executes arbitrary code during `pnpm install`\n\n**What an attacker can do:**\n- Execute arbitrary code with the victim's privileges\n- Exfiltrate environment variables, secrets, and credentials\n- Modify source code or inject backdoors\n- Establish persistence or reverse shells\n- Access the filesystem and network\n\n**Why this bypasses security expectations:**\n- pnpm v10 changelog explicitly states \"Lifecycle scripts of dependencies are not executed during installation by default\"\n- Users expect git dependencies to follow the same security model as npm registry packages\n- There is no warning that git dependencies are treated differently\n- The `onlyBuiltDependencies` configuration does not affect git dependencies",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "npm",
      "name" : "pnpm"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "10.0.0"
      }, {
        "fixed" : "10.26.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/pnpm/pnpm/security/advisories/GHSA-379q-355j-w6rj"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-69264"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/pnpm/pnpm/commit/73cc63504d9bc360c43e4b2feb9080677f03c5b5"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/pnpm/pnpm"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-693" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-01-07T19:07:43Z",
    "nvd_published_at" : "2026-01-07T22:15:43Z"
  }
}