pnpm CVE-2025-69264

The project must declare or transitively pull a git-hosted (git URL) dependency that is attacker-controlled, and the victim must run pnpm install with a vulnerable version (10.0.0-10.25). The specific condition is the git-fetch code path: prepare, prepublish, or prepack scripts in the git dependency's package.json run during fetch, bypassing the onlyBuiltDependencies allowlist that otherwise blocks postinstall. Limiting factors: exploitation does not fire against registry (npm-published) dependencies, only git-sourced ones; it requires a malicious dependency to be referenced in the first place (a supply-chain or social-engineering precondition rather than direct remote access); and pnpm 10.26.0+ is not affected.

The signals conflict and should be weighed carefully. NVD assigns CVSS 9.8 (AV:N/AC:L/PR:N/UI:N) with full C/I/A impact, consistent with developer/CI RCE, and a public PoC plus the GitHub Security Advisory confirm the technique is documented and reproducible. However, this is a supply-chain bypass: real exploitation depends on a victim adding or installing an attacker-controlled git-hosted dependency, which in practice is user-initiated - so UI:N likely overstates automaticity and a UI:R assessment (CVSS ~8.8) is more honest. The low EPSS (0.11%, 30th percentile) and absence from CISA KEV indicate no widespread or confirmed active exploitation; this reads as a high-severity, broadly-applicable weakness whose practical exploitation hinges on a poisoned or socially-engineered dependency reference rather than mass internet-facing attack. No SSVC decision data was provided in the input. Net: treat as a high-priority patch for any environment that installs git dependencies with pnpm v10, while recognizing the trigger requires a malicious dependency to enter the dependency tree.

An attacker publishes or compromises a git repository referenced as a pnpm dependency and places a malicious prepare/prepack script in its package.json. When a developer or CI pipeline runs pnpm install (v10.0.0-10.25) against a project that pulls that git dependency, the script executes automatically during the fetch phase - despite v10's lifecycle-script protections - granting code execution in the build environment. A public PoC for the technique exists in the GitHub advisory.