kritisch
CVE-2025-69264
pnpm: pnpm code execution
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Red Hat8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD. Niedriger laut GHSA (hoch), Red Hat (hoch).
Beschreibung
pnpm is a package manager. Versions 10.0.0 through 10.25 allow git-hosted dependencies to execute arbitrary code during pnpm install, circumventing the v10 security feature "Dependency lifecycle scripts execution disabled by default". While pnpm v10 blocks postinstall scripts via the onlyBuiltDependencies mechanism, git dependencies can still execute prepare, prepublish, and prepack scripts during the fetch phase, enabling remote code execution without user consent or approval. This issue is fixed in version 10.26.0.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| alpine 3.23 | pnpm | 10.33.4-r0 |
| minimos | pnpm | 10.26.0-r0 |
| npm::GitHub Security Advisory npm | pnpm | 10.26.0 |
| rapidfort alpine 3.20 | pnpm | 10.26.0-r0 |
| rapidfort alpine 3.21 | pnpm | 10.26.0-r0 |
| rapidfort alpine 3.22 | pnpm | 10.26.0-r0 |
| rapidfort fedora 43 | nodejs-pnpm, pnpm | 10.27.0-1.fc43 |
Alle 8 Einträge aus 7 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| alpine 3.23 | pnpm | 10.33.4-r0 |
| minimos | pnpm | 10.26.0-r0 |
| npm::GitHub Security Advisory npm | pnpm | 10.26.0 |
| rapidfort alpine 3.20 | pnpm | 10.26.0-r0 |
| rapidfort alpine 3.21 | pnpm | 10.26.0-r0 |
| rapidfort alpine 3.22 | pnpm | 10.26.0-r0 |
| rapidfort fedora 43 | nodejs-pnpm | 10.27.0-1.fc43 |
| rapidfort fedora 43 | pnpm | 10.27.0-1.fc43 |
Referenzen
- https://access.redhat.com/security/cve/CVE-2025-69264
- https://bugzilla.redhat.com/show_bug.cgi?id=2427709
- https://github.com/pnpm/pnpm
- https://github.com/pnpm/pnpm/commit/73cc63504d9bc360c43e4b2feb9080677f03c5b5
- https://github.com/pnpm/pnpm/security/advisories/GHSA-379q-355j-w6rj
- https://nvd.nist.gov/vuln/detail/CVE-2025-69264
- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69264.json
- https://www.cve.org/CVERecord?id=CVE-2025-69264