CVE-2025-69264 pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default"

pnpm is a package manager. Versions 10.0.0 through 10.25 allow git-hosted dependencies to execute arbitrary code during pnpm install, circumventing the v10 security feature "Dependency lifecycle scripts execution disabled by default". While pnpm v10 blocks postinstall scripts via the...

CVE-2025-69264

CVE-2025-69264 affects pnpm v10.x prior to 10.26.0. It describes a bypass where git-hosted dependencies can execute scripts during the FETCH phase of pnpm install, despite the v10 feature that disables dependency lifecycle scripts by default. Specifically, while postinstall scripts are blocked vi...