CVE-2025-69264

pnpm is a package manager. Versions 10.0.0 through 10.25 allow git-hosted dependencies to execute arbitrary code during pnpm install, circumventing the v10 security feature "Dependency lifecycle scripts execution disabled by default". While pnpm v10 blocks postinstall scripts via the onlyBuiltDependencies mechanism, git dependencies can still execute prepare, prepublish, and prepack scripts during the fetch phase, enabling remote code execution without user consent or approval. This issue is fixed in version 10.26.0.

• CWE-693
• CWE-693

• https://github.com/pnpm/pnpm/commit/73cc63504d9bc360c43e4b2feb9080677f03c5b5Patch
• https://github.com/pnpm/pnpm/security/advisories/GHSA-379q-355j-w6rjExploit, Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2025-69264
• https://bugzilla.redhat.com/show_bug.cgi?id=2427709
• https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69264.json

Published

Jan 7, 2026

Last Modified

Jul 15, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-69259A message unchecked NULL return value vulnerability in Trend…7.5
• CVE-2025-6926Improper Authentication vulnerability in Wikimedia Foundatio…8.8
• CVE-2025-69260A message out-of-bounds read vulnerability in Trend Micro Ap…7.5
• CVE-2025-69261WasmEdge is a WebAssembly runtime. Prior to version 0.16.0-a…7.5
• CVE-2025-69262pnpm is a package manager. Versions 6.25.0 through 10.26.2 h…7.8
• CVE-2025-69263pnpm is a package manager. Versions 10.26.2 and below store …8.8
• CVE-2025-69267Improper Limitation of a Pathname to a Restricted Directory …6.5
• CVE-2025-69268Improper Neutralization of Input During Web Page Generation …6.1
• CVE-2025-69269Improper Neutralization of Special Elements used in an OS Co…9.8
• CVE-2025-6927Vulnerability in Wikimedia Foundation MediaWiki. This vulner…2.3
• CVE-2025-69270Information Exposure Through Query Strings in GET Request vu…9.8
• CVE-2025-69271Insufficiently Protected Credentials vulnerability in Broadc…7.5