Security readout for executives and security teams
Plain-English summary
pnpm lockfiles may not pin some HTTP or git-hosted tarball dependencies with integrity hashes. A malicious package dependency could cause different code to be installed in developer or CI environments, weakening trust in reproducible builds.
Executive priority
Treat this as a high-priority software supply-chain issue for teams using pnpm. Prioritize build systems, release pipelines, and repositories that install dependencies from remote tarball URLs.
Technical view
The issue is CWE-494: download without integrity protection. For affected pnpm versions, HTTP tarball and git-hosted tarball entries can be recorded without integrity data, letting the remote host vary package contents across installs despite a committed lockfile.
Likely exposure
Exposure is most likely in Node.js projects using pnpm and dependency trees containing HTTP tarball or git-hosted tarball dependencies. CI/CD environments are a key concern because lockfile enforcement may not prevent content substitution.
Exploitation context
The bundle does not show KEV listing or cited evidence of active exploitation. Exploitation requires the victim to install a package whose dependency tree includes a remote tarball controlled or influenced by an attacker.
Researcher notes
The provided data contains a version inconsistency: the description mentions 10.26.2 and below, while affected versions list <10.26.0 and fixed version 10.26.0. Validate final scope against the pnpm advisory before broad remediation tracking.
Mitigation direction
- Upgrade pnpm to 10.26.0 or later per the provided fixed-version data.
- Audit dependency trees for HTTP tarball and git-hosted tarball dependencies.
- Prefer registry packages with integrity metadata over remote tarball URLs.
- Check the pnpm advisory for any corrected version-range guidance.
- Rebuild CI images that bundle older pnpm versions.
Validation and detection
- Check pnpm versions used by developers, CI runners, and build containers.
- Inspect pnpm lockfiles for HTTP tarball or git-hosted tarball entries.
- Review dependencies added from untrusted publishers or unusual tarball hosts.
- Confirm regenerated lockfiles include expected integrity protection after upgrade.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-494: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-69263 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H1.65.9GitHub_MCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H1.65.9redhat-SADPVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- ADP timelineredhat-SADP
Made public.
- CVE publishedCVE Program
The CVE record was published.
- ADP timelineredhat-SADP
Reported to Red Hat.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
- 2026-01-07T22:01:36.955Z: Reported to Red Hat.
- 2026-01-07T21:31:07.567Z: Made public.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/pnpm/pnpm/security/advisories/GHSA-7vhp-vf5g-r2fwCVE reference, GitHub_M · x_refsource_CONFIRM
- https://github.com/pnpm/pnpm/commit/0958027f88a99ccefe7e9676cdebba393dfbdc85CVE reference, GitHub_M · x_refsource_MISC
- https://access.redhat.com/security/cve/CVE-2025-69263CVE reference, redhat-SADP · vdb-entry, x_refsource_REDHAT
- RHBZ#2427703CVE reference, redhat-SADP · issue-tracking, x_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-69263.jsonCVE reference, redhat-SADP · x_sadp-csaf-vex
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Download of Code Without Integrity Check
Download of Code Without Integrity Check represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.