crítica
CVE-2025-69264
pnpm: pnpm code execution
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Red Hat8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según GHSA (alta), Red Hat (alta).
Descripción
pnpm is a package manager. Versions 10.0.0 through 10.25 allow git-hosted dependencies to execute arbitrary code during pnpm install, circumventing the v10 security feature "Dependency lifecycle scripts execution disabled by default". While pnpm v10 blocks postinstall scripts via the onlyBuiltDependencies mechanism, git dependencies can still execute prepare, prepublish, and prepack scripts during the fetch phase, enabling remote code execution without user consent or approval. This issue is fixed in version 10.26.0.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| alpine 3.23 | pnpm | 10.33.4-r0 |
| minimos | pnpm | 10.26.0-r0 |
| npm::GitHub Security Advisory npm | pnpm | 10.26.0 |
| rapidfort alpine 3.20 | pnpm | 10.26.0-r0 |
| rapidfort alpine 3.21 | pnpm | 10.26.0-r0 |
| rapidfort alpine 3.22 | pnpm | 10.26.0-r0 |
| rapidfort fedora 43 | nodejs-pnpm, pnpm | 10.27.0-1.fc43 |
Mostrar las 8 entradas de 7 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| alpine 3.23 | pnpm | 10.33.4-r0 |
| minimos | pnpm | 10.26.0-r0 |
| npm::GitHub Security Advisory npm | pnpm | 10.26.0 |
| rapidfort alpine 3.20 | pnpm | 10.26.0-r0 |
| rapidfort alpine 3.21 | pnpm | 10.26.0-r0 |
| rapidfort alpine 3.22 | pnpm | 10.26.0-r0 |
| rapidfort fedora 43 | nodejs-pnpm | 10.27.0-1.fc43 |
| rapidfort fedora 43 | pnpm | 10.27.0-1.fc43 |
Referencias
- https://access.redhat.com/security/cve/CVE-2025-69264
- https://bugzilla.redhat.com/show_bug.cgi?id=2427709
- https://github.com/pnpm/pnpm
- https://github.com/pnpm/pnpm/commit/73cc63504d9bc360c43e4b2feb9080677f03c5b5
- https://github.com/pnpm/pnpm/security/advisories/GHSA-379q-355j-w6rj
- https://nvd.nist.gov/vuln/detail/CVE-2025-69264
- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69264.json
- https://www.cve.org/CVERecord?id=CVE-2025-69264