Integrity Bypass in pnpm Lockfile Enables Remote Code Injection

Publication date: 2026-01-07

Last updated on: 2026-06-30

Assigner: GitHub, Inc.

Description

pnpm is a package manager. Versions 10.26.2 and below store HTTP tarball dependencies (and git-hosted tarballs) in the lockfile without integrity hashes. This allows the remote server to serve different content on each install, even when a lockfile is committed. An attacker who publishes a package with an HTTP tarball dependency can serve different code to different users or CI/CD environments. The attack requires the victim to install a package that has an HTTP/git tarball in its dependency tree. The victim's lockfile provides no protection. This issue is fixed in version 10.26.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-01-07

Last Modified

2026-06-30

Generated

2026-07-06

AI Q&A

2026-01-08

EPSS Evaluated

2026-07-05

NVD

CVE-2025-69263

Affected Vendors & Products

Vendor	Product	Version / Range
pnpm	pnpm	to 10.26.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-494	The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.

Attack-Flow Graph

Executive Summary

This vulnerability in pnpm (versions 10.26.2 and below) involves storing HTTP tarball dependencies and git-hosted tarballs in the lockfile without integrity hashes. Because of this, a remote server can serve different content on each install, even if the lockfile is committed. An attacker who publishes a package with an HTTP tarball dependency can exploit this to serve different code to different users or CI/CD environments. The victim's lockfile does not protect against this attack. The issue is fixed in version 10.26.0.

Impact Analysis

This vulnerability can allow an attacker to serve different, potentially malicious code to different users or automated environments during package installation. This can lead to compromise of systems, unauthorized code execution, and potentially severe impacts on confidentiality, integrity, and availability of affected systems.

Mitigation Strategies

Upgrade pnpm to version 10.26.0 or later, as this version fixes the vulnerability related to storing HTTP tarball dependencies without integrity hashes.

Hi! I’m here to help you understand CVE-2025-69263. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70