{"id":"CVE-2025-69263","title":"pnpm is a package manager","summary":"pnpm is a package manager. Versions 10.26.2 and below store HTTP tarball dependencies (and git-hosted tarballs) in the lockfile without integrity hashes. This allows the remote server to serve different content on each install, even when…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cwe":["CWE-494"],"published":"2026-01-07","updated":"2026-06-22","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-69263","references":[{"url":"https://github.com/pnpm/pnpm/commit/0958027f88a99ccefe7e9676cdebba393dfbdc85","label":"security-advisories@github.com"},{"url":"https://github.com/pnpm/pnpm/security/advisories/GHSA-7vhp-vf5g-r2fw","label":"security-advisories@github.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69263.json"},{"url":"https://access.redhat.com/security/cve/CVE-2025-69263"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2427703"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-69263"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-69263"}],"tags":["nvd","csaf","vex","red-hat","cve.org","exploit-available"],"epss":0.00434,"epssPercentile":0.37034,"ingestedAt":"2026-06-29T13:24:34.625Z","vendor":"Red Hat","product":"pnpm","affected":["pnpm < 10.26.0"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-01-09T04:55:27.484400Z"},"slug":"CVE-2025-69263","body":"## Overview\n\npnpm is a package manager. Versions 10.26.2 and below store HTTP tarball dependencies (and git-hosted tarballs) in the lockfile without integrity hashes. This allows the remote server to serve different content on each install, even when a lockfile is committed. An attacker who publishes a package with an HTTP tarball dependency can serve different code to different users or CI/CD environments. The attack requires the victim to install a package that has an HTTP/git tarball in its dependency tree. The victim's lockfile provides no protection. This issue is fixed in version 10.26.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · updated 2026-09-12 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69263.json)","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":201421,"id":"CVE-2025-69263","ts":1789399448117,"field":"exploit_available","old":"false","new":"true"},{"seq":200156,"id":"CVE-2025-69263","ts":1789396899993,"field":"exploit_available","old":"true","new":"false"},{"seq":199319,"id":"CVE-2025-69263","ts":1789395379347,"field":"exploit_available","old":"false","new":"true"}]}