A critical vulnerability in pnpm versions 10.0.0 through 10.25 allows unauthenticated attackers to achieve remote code execution via malicious git-hosted dependencies.

The vulnerability stems from a failure in the protection mechanism where git dependencies can execute prepare, prepublish, and prepack scripts during the fetch phase. This bypasses the intended security controls that disable dependency lifecycle scripts by default, allowing for unauthenticated remote code execution.

The ability for an attacker to execute arbitrary code during a package installation presents a severe risk to development environments and CI/CD pipelines. Successful exploitation could lead to full system compromise, the theft of sensitive source code or credentials, and the potential for supply chain poisoning. With a CVSS score of 8.8, this vulnerability represents a high-severity threat to organizational integrity and software security.

Immediate Action: Update pnpm to version 10.26.0 or later immediately to resolve the lifecycle script execution flaw.

Proactive Monitoring: Monitor build logs and CI/CD execution environments for unexpected network connections or unauthorized file system modifications during the pnpm install phase.

Compensating Controls: Restrict the use of git-hosted dependencies in project configurations and enforce the use of verified lockfiles to prevent the introduction of unvetted or malicious packages.

Public Exploit Available: Unknown

Given the potential for remote code execution and the availability of a proof-of-concept, this vulnerability poses a significant risk to the software supply chain. Organizations should prioritize updating all instances of pnpm to version 10.26.0 across both developer workstations and automated build environments to eliminate this attack vector.