CVE-2025-69263
Unknown Unknown - Not Provided
Integrity Bypass in pnpm Lockfile Enables Remote Code Injection

Publication date: 2026-01-07

Last updated on: 2026-01-07

Assigner: GitHub, Inc.

Description
pnpm is a package manager. Versions 10.26.2 and below store HTTP tarball dependencies (and git-hosted tarballs) in the lockfile without integrity hashes. This allows the remote server to serve different content on each install, even when a lockfile is committed. An attacker who publishes a package with an HTTP tarball dependency can serve different code to different users or CI/CD environments. The attack requires the victim to install a package that has an HTTP/git tarball in its dependency tree. The victim's lockfile provides no protection. This issue is fixed in version 10.26.0.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-01-07
Last Modified
2026-01-07
Generated
2026-06-16
AI Q&A
2026-01-08
EPSS Evaluated
2026-06-14
NVD
CVE-2025-69263
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
pnpm pnpm 10.26.0
pnpm pnpm to 10.26.0 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-494 The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability in pnpm (versions 10.26.2 and below) involves storing HTTP tarball dependencies and git-hosted tarballs in the lockfile without integrity hashes. Because of this, a remote server can serve different content on each install, even if the lockfile is committed. An attacker who publishes a package with an HTTP tarball dependency can exploit this to serve different code to different users or CI/CD environments. The victim's lockfile does not protect against this attack. The issue is fixed in version 10.26.0.

Impact Analysis

This vulnerability can allow an attacker to serve different, potentially malicious code to different users or automated environments during package installation. This can lead to compromise of systems, unauthorized code execution, and potentially severe impacts on confidentiality, integrity, and availability of affected systems.

Mitigation Strategies

Upgrade pnpm to version 10.26.0 or later, as this version fixes the vulnerability related to storing HTTP tarball dependencies without integrity hashes.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-69263. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart