Is CVE-2025-69263 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-69263 being exploited in the wild.

How severe is CVE-2025-69263?

High severity, with a CVSS score of 7.5, published 7 January 2026.

Which products and versions are affected?

pnpm (npm) SEMVER:introduced=0,fixed=10.26.0.

Is there a fix for CVE-2025-69263?

Yes. pnpm (npm): upgrade to 10.26.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-69263 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-69263?

Check whether you run pnpm (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-69263: pnpm lockfile integrity bypass in HTTP and Git dependencies

CVE-2025-69263 · Severity: high · CVSS 7.5 · Published 2026-01-07

pnpm is a popular package manager used by developers to manage software dependencies. A vulnerability exists where certain types of dependencies (specifically those hosted as HTTP or Git tarballs) are saved without security fingerprints in the project's lockfile. This allows a malicious server to swap safe code for malicious code during subsequent installations, potentially leading to the execution of unauthorized software in developer environments or automated build systems.

Technologies: pnpm (npm). Vendors: npm.

Quick answers

Is CVE-2025-69263 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-69263 being exploited in the wild.
How severe is CVE-2025-69263?: High severity, with a CVSS score of 7.5, published 7 January 2026.
Which products and versions are affected?: pnpm (npm) SEMVER:introduced=0,fixed=10.26.0.
Is there a fix for CVE-2025-69263?: Yes. pnpm (npm): upgrade to 10.26.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-69263 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-69263?: Check whether you run pnpm (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

pnpm (npm): upgrade to 10.26.0 or later
```
npm install pnpm@10.26.0
```

Technical details

A vulnerability in pnpm's tarball resolver (specifically within the resolving/tarball-resolver component) causes it to omit integrity hashes when processing HTTP/HTTPS tarball URLs and Git-hosted dependencies. Because the lockfile lacks an 'integrity' field for these entries, pnpm cannot verify if the downloaded content has changed since the initial resolution. An attacker who controls the remote server or the dependency tree can perform a supply chain attack by serving benign code during initial audits and malicious code during later CI/CD runs or user installs. This issue affects HTTP/HTTPS URLs, Git shorthand (e.g., github:user/repo), and Git URLs, but does not affect standard npm registry packages. The vulnerability is fixed in version 10.26.0.

Affected products

pnpm pnpm < 10.26.0

Identifiers

CVE-2025-69263
GHSA-7vhp-vf5g-r2fw

Timeline

2026-01-07: disclosed
2026-01-07: advisory
2026-01-07: patched: Fixed in version 10.26.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.