7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-69263

CVE-2025-69263: pnpm Lockfile Integrity Bypass Allows Remote Dynamic Dependencies

pnpm is a package manager. Versions 10.26.2 and below store HTTP tarball dependencies (and git-hosted tarballs) in the lockfile without integrity hashes. This allows the remote server to serve different content on each install, even when a lockfile is committed. An attacker who publishes a package with an HTTP tarball dependency can serve different code to different users or CI/CD environments. The attack requires the victim to install a package that has an HTTP/git tarball in its dependency tree. The victim's lockfile provides no protection. This issue is fixed in version 10.26.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-69263

CVE-2025-69263:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
pnpm	npm	< 10.26.0	10.26.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, as described, is a lockfile integrity bypass for remote dependencies like HTTP tarballs and git repositories. The root cause is that pnpm did not calculate and store an integrity hash for these dependencies in the lockfile. This would allow a malicious server to serve different, potentially malicious, content for the same dependency URL across different installations without pnpm detecting the change.

The analysis of the commits between the vulnerable and patched versions reveals the fix. The primary patch is in commit b7d3ec65b1024b7814179e862cb620779e78ff7a. It addresses the core issue by modifying the package fetching and storing process.

Integrity Calculation: The function addTarballToStore in worker/src/start.ts is modified to calculate a SHA-512 integrity hash of the tarball content if an integrity hash is not already present. This ensures that every fetched tarball has an associated integrity hash.
Integrity Propagation: The resolveAndFetch function in pkg-manager/package-requester/src/packageRequester.ts is updated to take this newly computed integrity hash and add it to the package's resolution data. This is the crucial step that ensures the integrity hash is written into the pnpm-lock.yaml file.

A secondary, related fix in commit 40775391d54d400c7d516bffaca667215a5e472d hardens the handling of git-hosted dependencies. The preparePackage function in exec/prepare-package/src/index.ts was modified to prevent the automatic execution of prepare scripts from git dependencies unless they are explicitly trusted via the onlyBuiltDependencies setting. This mitigates a related risk for one of the dependency types affected by the integrity bypass.

In summary, an exploit would involve a user installing a package with a malicious HTTP or git dependency. The identified vulnerable functions would be part of the pnpm's internal dependency resolution and fetching process that runs during pnpm install.

Vulnerable functions

addTarballToStore

worker/src/start.ts

This function is responsible for adding a fetched tarball's contents to the pnpm store. Before the patch, it did not calculate an integrity hash for the tarball if one was not already provided. This meant that for HTTP-based dependencies, no integrity was stored in the lockfile, allowing a remote server to alter the package content between installs without pnpm detecting it. The patch adds the `calcIntegrity` function and ensures that an integrity hash is always computed and returned.

resolveAndFetch

pkg-manager/package-requester/src/packageRequester.ts

This function resolves a dependency and fetches its content. The vulnerable version of this function did not propagate the integrity hash (computed during the fetch) to the package's resolution data. As a result, the integrity hash was not saved to the lockfile, leaving subsequent installations vulnerable to tampering. The patch ensures that if an integrity hash is computed, it is added to the resolution object, which is then persisted in the lockfile.

preparePackage

exec/prepare-package/src/index.ts

This function prepares a package, which may involve running build scripts (`prepare` scripts). The vulnerability advisory mentions that git-hosted dependencies are also affected. This patch adds a security control to prevent arbitrary code execution from the `prepare` scripts of git-hosted dependencies by checking them against an allowlist (`onlyBuiltDependencies`). While not the primary fix for the integrity bypass, it's a related hardening measure for one of the affected dependency types.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.