High · published January 8, 2026
⚡ A sneaky git-hosted dependency could run arbitrary code during your `pnpm install` — think of it as a remote chef sneaking in to cook without permission! Imagine ordering a meal but a stranger slips in to add their secret ingredient without you knowing. That’s how these git dependencies can execute scripts, bypassing the security features you thought were in place. This vulnerability allows an attacker to execute malicious code on your system without consent, potentially jeopardizing your entire project. It’s a high-stakes game where your development environment could be compromised, leaving your data and users at risk.
Imagine ordering a meal but a stranger slips in to add their secret ingredient without you knowing. That’s how these git dependencies can execute scripts, bypassing the security features you thought were in place. Versions 10.0.0 to 10.25 of pnpm permit git dependencies to run specific scripts — prepare, prepublish, and prepack — during installation, despite the `onlyBuiltDependencies` feature being designed to block unauthorized script execution. This flaw enables remote code execution, which could be devastating.
This vulnerability allows an attacker to execute malicious code on your system without consent, potentially jeopardizing your entire project. It’s a high-stakes game where your development environment could be compromised, leaving your data and users at risk. Update pnpm immediately to version 10.26.0 to close this loophole. Make sure to review your dependencies for any untrusted git sources and consider implementing additional security measures to monitor script execution in the future. You’ve got this! By taking these steps, you’ll lock down your environment and keep those sneaky scripts at bay! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| pnpm/pnpm | ≥ 10.0.0, < 10.26.0 | 10.26.0 |