Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2025-69263

CVE-2025-69263HIGH

pnpm Lockfile Integrity Bypass Allows Remote Dynamic Dependencies

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   R  U  H  H  H    8.8   .0047   39.6     —

AFFECTED
  Product  Versions     Fixed
  pnpm     < 10.26.0 –  —

TIMELINE
  Dec 30  Reserved by GitHub_M
  Jan 7   Published (CNA: GitHub_M)
  Oct 14  EXPLOIT PUBLISHED — CVE-2025-69263 (pnpm). Public exploit reference added.
  Oct 14  RESCORED — CVE-2025-69263 (pnpm). CVSS 7.5 → 8.8 (NVD).

CWE-494 · CNA: GitHub_M · CVSS v3.1 · 5 references · NVD status: Modified

Description

pnpm is a package manager. Versions 10.26.2 and below store HTTP tarball dependencies (and git-hosted tarballs) in the lockfile without integrity hashes. This allows the remote server to serve different content on each install, even when a lockfile is committed. An attacker who publishes a package with an HTTP tarball dependency can serve different code to different users or CI/CD environments. The attack requires the victim to install a package that has an HTTP/git tarball in its dependency tree. The victim's lockfile provides no protection. This issue is fixed in version 10.26.0.

Lifecycle

Complete event history — 4 events, chronological
Date	Event	Detail
December 30, 2025	Reserved	Reserved by GitHub_M
January 7, 2026	Published	Published (CNA: GitHub_M)
October 14, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2025-69263 (pnpm). Public exploit reference added.
October 14, 2026	RESCORED	RESCORED — CVE-2025-69263 (pnpm). CVSS 7.5 → 8.8 (NVD).

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
pnpm	pnpm	—	< 10.26.0	—

Weaknesses

CWE-494

References (5)

Authoritative record: CVE-2025-69263 at cve.org

Vendors: pnpm

Weaknesses: CWE-494

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2025-69263 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.