Security readout for executives and security teams
Plain-English summary
pnpm lockfiles may not protect against certain remote tarball dependencies changing between installs. If a project installs a package whose dependency tree includes an HTTP or git-hosted tarball, different code could be delivered to developers or CI despite a committed lockfile.
Executive priority
Prioritize remediation for software delivery pipelines and products built with pnpm. The business risk is supply-chain integrity failure: CI may build code different from what reviewers expect, undermining release trust even with lockfiles committed.
Technical view
CVE-2025-69263 is a CWE-494 lockfile integrity issue in pnpm. Sources state affected versions are below 10.26.0, while the description also mentions 10.26.2 and below; treat version evidence as inconsistent. The issue is fixed in 10.26.0 according to the bundle.
Likely exposure
Exposure is most likely in JavaScript/TypeScript build pipelines using pnpm with dependency trees containing HTTP tarball or git-hosted tarball dependencies. Projects relying on lockfiles for reproducible installs may be exposed if they use affected pnpm versions.
Exploitation context
No KEV listing is provided, so active exploitation is not established from the supplied sources. The described attack requires user interaction: the victim must install a package whose dependency tree includes an affected remote tarball dependency.
Researcher notes
Key evidence supports an integrity bypass for remote tarball dependencies in pnpm lockfiles. The bundle contains inconsistent affected-version wording, so remediation should cite the advisory directly. No exploit code, exploitation confirmation, or broad product impact beyond pnpm is provided.
Mitigation direction
- Upgrade pnpm to the vendor-identified fixed version, 10.26.0 or later.
- Verify exact affected and fixed versions against the pnpm advisory due source version inconsistency.
- Audit dependency trees for HTTP tarball and git-hosted tarball dependencies.
- Avoid untrusted remote tarball dependencies in build and CI workflows.
- Update CI images and developer tooling that pin older pnpm versions.
Validation and detection
- Inventory pnpm versions used locally, in CI, and in build containers.
- Inspect pnpm lockfiles for HTTP or git-hosted tarball dependency entries.
- Review dependency manifests for packages that introduce remote tarball dependencies.
- Confirm refreshed builds use the fixed pnpm version consistently.
- Monitor vendor and Red Hat entries for downstream package status.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-494: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-69263 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H1.65.9GitHub_MCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H1.65.9redhat-SADPVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- ADP timelineredhat-SADP
Made public.
- CVE publishedCVE Program
The CVE record was published.
- ADP timelineredhat-SADP
Reported to Red Hat.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-01-07T22:01:36.955Z: Reported to Red Hat.
- 2026-01-07T21:31:07.567Z: Made public.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/pnpm/pnpm/security/advisories/GHSA-7vhp-vf5g-r2fwCVE reference, GitHub_M · x_refsource_CONFIRM
- https://github.com/pnpm/pnpm/commit/0958027f88a99ccefe7e9676cdebba393dfbdc85CVE reference, GitHub_M · x_refsource_MISC
- https://access.redhat.com/security/cve/CVE-2025-69263CVE reference, redhat-SADP · vdb-entry, x_refsource_REDHAT
- RHBZ#2427703CVE reference, redhat-SADP · issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69263.jsonCVE reference, redhat-SADP · x_sadp-csaf-vex
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Download of Code Without Integrity Check
Download of Code Without Integrity Check represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.