ZeroDay Findings
Sign inSign up

Findings

CVE-2025-69263

pnpm is a package manager.

Published Jan 7, 2026 · updated Oct 14, 2026 · pnpm pnpm

pnpm is a package manager. Versions 10.26.2 and below store HTTP tarball dependencies (and git-hosted tarballs) in the lockfile without integrity hashes. This allows the remote server to serve different content on each install, even when a lockfile is committed. An attacker who publishes a package with an HTTP tarball dependency can serve different code to different users or CI/CD environments. The attack requires the victim to install a package that has an HTTP/git tarball in its dependency tree. The victim's lockfile provides no protection. This issue is fixed in version 10.26.0.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Jan 7, 2026 · NIST NVD

    Detected

    pnpm is a package manager. Versions 10.26.2 and below store HTTP tarball dependencies (and git-hosted tarballs) in the lockfile without integrity hashes. This allows the remote server to serve different content on each install, even when a lockfile is committed. An attacker who publishes a package with an HTTP tarball dependency can serve different code to different users or CI/CD environments. Th

  2. Oct 14, 2026 · NIST NVD

    Updated

    pnpm is a package manager. Versions 10.26.2 and below store HTTP tarball dependencies (and git-hosted tarballs) in the lockfile without integrity hashes. This allows the remote server to serve different content on each install, even when a lockfile is committed. An attacker who publishes a package with an HTTP tarball dependency can serve different code to different users or CI/CD environments. Th

Affected

  • cpe pnpm/pnpmversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2025-69263

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2025-69263

    30-day exploitation probability 0.5%

    first.org
  • NIST NVDVulnerability recordCVE-2025-69263

    pnpm is a package manager. Versions 10.26.2 and below store HTTP tarball dependencies (and git-hosted tarballs) in the lockfile without integrity hashes. This allows the remote server to serve different content on each install, even when a lockfile is committed. An attacker who p

    nvd.nist.gov

References