CVE-2025-69263
Integrity Bypass in pnpm Lockfile Enables Remote Code Injection
Publication date: 2026-01-07
Last updated on: 2026-01-07
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| pnpm | pnpm | 10.26.0 |
| pnpm | pnpm | to 10.26.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-494 | The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability in pnpm (versions 10.26.2 and below) involves storing HTTP tarball dependencies and git-hosted tarballs in the lockfile without integrity hashes. Because of this, a remote server can serve different content on each install, even if the lockfile is committed. An attacker who publishes a package with an HTTP tarball dependency can exploit this to serve different code to different users or CI/CD environments. The victim's lockfile does not protect against this attack. The issue is fixed in version 10.26.0.
How can this vulnerability impact me? :
This vulnerability can allow an attacker to serve different, potentially malicious code to different users or automated environments during package installation. This can lead to compromise of systems, unauthorized code execution, and potentially severe impacts on confidentiality, integrity, and availability of affected systems.
What immediate steps should I take to mitigate this vulnerability?
Upgrade pnpm to version 10.26.0 or later, as this version fixes the vulnerability related to storing HTTP tarball dependencies without integrity hashes.