CVE-2025-69263

pnpm is a package manager. Versions 10.26.2 and below store HTTP tarball dependencies (and git-hosted tarballs) in the lockfile without integrity hashes. This allows the remote server to serve different content on each install, even when a lockfile is committed. An attacker who publishes a package with an HTTP tarball dependency can serve different code to different users or CI/CD environments. The attack requires the victim to install a package that has an HTTP/git tarball in its dependency tree. The victim's lockfile provides no protection. This issue is fixed in version 10.26.0.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.6 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/pnpm/pnpm/commit/0958027f88a99ccefe7e9676cdebba393dfbdc85	Patch
https://github.com/pnpm/pnpm/security/advisories/GHSA-7vhp-vf5g-r2fw	Exploit Vendor Advisory
https://access.redhat.com/security/cve/CVE-2025-69263
https://bugzilla.redhat.com/show_bug.cgi?id=2427703
https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69263.json

Configurations

Configuration 1 (hide)

cpe:2.3:a:pnpm:pnpm:*:*:*:*:*:node.js:*:*

History

14 Oct 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) pnpm es un gestor de paquetes. Las versiones 10.26.2 e inferiores almacenan dependencias tarball HTTP (y tarballs alojados en git) en el lockfile sin hashes de integridad. Esto permite al servidor remoto servir contenido diferente en cada instalación, incluso cuando se ha confirmado un lockfile. Un atacante que publica un paquete con una dependencia tarball HTTP puede servir código diferente a diferentes usuarios o entornos CI/CD. El ataque requiere que la víctima instale un paquete que tenga un tarball HTTP/git en su árbol de dependencias. El lockfile de la víctima no proporciona protección. Este problema está solucionado en la versión 10.26.0.

Information

Published : 2026-01-07 22:15

Updated : 2026-10-14 16:10

NVD link : CVE-2025-69263

Mitre link : CVE-2025-69263

CVE.ORG link : CVE-2025-69263

JSON object : View

Products Affected

pnpm

pnpm

CWE

CWE-494

Download of Code Without Integrity Check

{"id": "CVE-2025-69263", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-69263", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-01-09T04:55:27.484400Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.6}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.6}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "pnpm", "product": "pnpm", "versions": [{"status": "affected", "version": "< 10.26.0"}]}]}, {"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "affectedData": [{"cpes": ["cpe:/a:redhat:jboss_enterprise_application_platform:8"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform 8", "packageName": "org.keycloak-keycloak-parent", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:jbosseapxp"], "vendor": "Red Hat", "product": "Red Hat JBoss Enterprise Application Platform Expansion Pack", "packageName": "org.keycloak-keycloak-parent", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "unaffected"}]}], "published": "2026-01-07T22:15:43.727", "references": [{"url": "https://github.com/pnpm/pnpm/commit/0958027f88a99ccefe7e9676cdebba393dfbdc85", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/pnpm/pnpm/security/advisories/GHSA-7vhp-vf5g-r2fw", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://access.redhat.com/security/cve/CVE-2025-69263", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2427703", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}, {"url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69263.json", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-494"}]}, {"type": "Secondary", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "description": [{"lang": "en", "value": "CWE-494"}]}], "descriptions": [{"lang": "en", "value": "pnpm is a package manager. Versions 10.26.2 and below store HTTP tarball dependencies (and git-hosted tarballs) in the lockfile without integrity hashes. This allows the remote server to serve different content on each install, even when a lockfile is committed. An attacker who publishes a package with an HTTP tarball dependency can serve different code to different users or CI/CD environments. The attack requires the victim to install a package that has an HTTP/git tarball in its dependency tree. The victim's lockfile provides no protection. This issue is fixed in version 10.26.0."}, {"lang": "es", "value": "pnpm es un gestor de paquetes. Las versiones 10.26.2 e inferiores almacenan dependencias tarball HTTP (y tarballs alojados en git) en el lockfile sin hashes de integridad. Esto permite al servidor remoto servir contenido diferente en cada instalaci\u00f3n, incluso cuando se ha confirmado un lockfile. Un atacante que publica un paquete con una dependencia tarball HTTP puede servir c\u00f3digo diferente a diferentes usuarios o entornos CI/CD. El ataque requiere que la v\u00edctima instale un paquete que tenga un tarball HTTP/git en su \u00e1rbol de dependencias. El lockfile de la v\u00edctima no proporciona protecci\u00f3n. Este problema est\u00e1 solucionado en la versi\u00f3n 10.26.0."}], "lastModified": "2026-10-14T16:10:00.250", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:pnpm:pnpm:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "7C8D4B2D-4CD1-4903-8C99-FF331EC7B624", "versionEndExcluding": "10.26.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}