Is CVE-2025-69264 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-69264 being exploited in the wild.

How severe is CVE-2025-69264?

High severity, with a CVSS score of 8.8, published 7 January 2026.

Which products and versions are affected?

pnpm (npm) SEMVER:introduced=10.0.0,fixed=10.26.0.

Is there a fix for CVE-2025-69264?

Yes. pnpm (npm): upgrade to 10.26.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-69264 attacked?

It is attacked over the network or with local access, in a software library.

Am I affected by CVE-2025-69264?

Check whether you run pnpm (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-69264: pnpm arbitrary code execution via Git dependency script bypass

CVE-2025-69264 · Severity: high · CVSS 8.8 · Published 2026-01-07

pnpm is a fast package manager used by developers to install and manage JavaScript dependencies. pnpm v10 introduced a security feature to prevent malicious packages from automatically running installation scripts, protecting developers from supply chain attacks. However, this protection was accidentally bypassed for git-hosted dependencies—allowing attackers to inject malicious code that runs without warning during installation. An attacker could compromise a git repository and add code that steals secrets, modifies source code, or establishes persistence on a developer's machine or CI/CD pipeline.

Technologies: pnpm (npm). Vendors: npm.

Quick answers

Is CVE-2025-69264 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-69264 being exploited in the wild.
How severe is CVE-2025-69264?: High severity, with a CVSS score of 8.8, published 7 January 2026.
Which products and versions are affected?: pnpm (npm) SEMVER:introduced=10.0.0,fixed=10.26.0.
Is there a fix for CVE-2025-69264?: Yes. pnpm (npm): upgrade to 10.26.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-69264 attacked?: It is attacked over the network or with local access, in a software library.
Am I affected by CVE-2025-69264?: Check whether you run pnpm (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pnpm (npm): upgrade to 10.26.0 or later
```
npm install pnpm@10.26.0
```

Technical details

This is a protection mechanism bypass (CWE-693) in the pnpm package manager. pnpm v10 introduced onlyBuiltDependencies, an allowlist that blocks packages from executing lifecycle scripts during the BUILD phase. However, git-hosted dependencies are processed in a separate FETCH phase via preparePackage(), which only checks the ignoreScripts flag (which defaults to false) and never consults onlyBuiltDependencies. This means git dependencies can execute prepare, prepublish, and prepack scripts even when the global security policy disables scripts. Attack vectors include git+https://, github:, gitlab:, bitbucket:, git+ssh://, and git+file:// protocols. The vulnerability requires network/local access and user interaction (running pnpm install), but no privileges are needed. Attackers can achieve arbitrary code execution with victim privileges. The patch was released in pnpm v10.26.0, implementing a blockExoticSubdeps option to restrict transitive dependencies to trusted sources.

Affected products

npm pnpm >=10.0.0, <10.26.0

Identifiers

CVE-2025-69264
GHSA-379q-355j-w6rj

Timeline

2026-01-07: disclosed
2026-01-10: patched: v10.26.0 includes blockExoticSubdeps feature to restrict exotic subdependencies

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.