CVE-2025-69264: pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default"
No fix listed · Affected: pnpm · Exploitation: not established
ExploitationNot established
Not in CISA KEV as of catalogue 2026.11.13 (13 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public: not seen
- Not establishedNothing in the sources we check
Higher than 63% of scored CVEs
DescriptionNVD
pnpm is a package manager. Versions 10.0.0 through 10.25 allow git-hosted dependencies to execute arbitrary code during pnpm install, circumventing the v10 security feature "Dependency lifecycle scripts execution disabled by default". While pnpm v10 blocks postinstall scripts via the onlyBuiltDependencies mechanism, git dependencies can still execute prepare, prepublish, and prepack scripts during the fetch phase, enabling remote code execution without user consent or approval. This issue is fixed in version 10.26.0.
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Possible (1 to 10%). EPSS between 1% and 10%.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Vendor
- pnpm
- Published
- January 2026
Coverage1 article · 1 outlet
First in our coverage: SecurityWeek, 27 Jan.
- ‘PackageGate’ Flaws Open JavaScript Ecosystem to Supply Chain AttacksSecurityWeek · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.