npm/pnpm CVE-2025-69264: high 8.8, EPSS 1.01%
pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default"
Action: Upgrade pnpm to 10.26.0 or later.
npm i pnpm@10.26.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 10.0.0 | 10.26.0 | - |
Fixed versions
| 10.26.0 |
Sources
- osv: GHSA-379q-355j-w6rj
- https://github.com/pnpm/pnpm/security/advisories/GHSA-379q-355j-w6rj
- https://nvd.nist.gov/vuln/detail/CVE-2025-69264
- https://github.com/pnpm/pnpm/commit/73cc63504d9bc360c43e4b2feb9080677f03c5b5
- https://github.com/pnpm/pnpm
CVE-2025-69264 · published · modified · JSON