8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-69264

CVE-2025-69264: pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default"

pnpm is a package manager. Versions 10.0.0 through 10.25 allow git-hosted dependencies to execute arbitrary code during pnpm install, circumventing the v10 security feature "Dependency lifecycle scripts execution disabled by default". While pnpm v10 blocks postinstall scripts via the onlyBuiltDependencies mechanism, git dependencies can still execute prepare, prepublish, and prepack scripts during the fetch phase, enabling remote code execution without user consent or approval. This issue is fixed in version 10.26.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-69264

CVE-2025-69264:

8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pnpm	npm	>= 10.0.0, < 10.26.0	10.26.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists because pnpm's security feature to disable dependency lifecycle scripts by default was not being applied to git-hosted dependencies. The core of the issue lies in the preparePackage function within exec/prepare-package/src/index.ts. This function is responsible for preparing git dependencies and was executing prepare, prepublish, and prepack scripts without checking against the onlyBuiltDependencies configuration that governs script execution.

The patch addresses this by introducing an allowBuild function that checks if a package is authorized to run build scripts. This check is added at the beginning of the preparePackage function. If a git-hosted dependency with a prepare script (or other lifecycle scripts) is not explicitly listed in onlyBuiltDependencies, the installation is now blocked, preventing the remote code execution vulnerability. The fix was propagated up the call stack to functions like gitFetcher to ensure the allowBuild setting is passed correctly during the package fetching phase.

Vulnerable functions

preparePackage

exec/prepare-package/src/index.ts

The `preparePackage` function is responsible for preparing git-hosted dependencies. Before the patch, it did not check whether the dependency was allowed to execute lifecycle scripts. It would unconditionally call `runLifecycleHook` for scripts like `prepare`, `prepublish`, and `prepack`, leading to arbitrary code execution if a malicious git dependency was used. The patch adds a check using a new `allowBuild` function to ensure the dependency is in the allowlist before executing any scripts.

createGitFetcher.gitFetcher

fetching/git-fetcher/src/index.ts

This inner function `gitFetcher` is responsible for fetching git repositories. It calls the vulnerable `preparePackage` function. The patch modifies it to pass down the `allowBuild` check, which was previously missing, thus allowing `preparePackage` to enforce the security policy.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.