What is the CVSS score of CVE-2025-69263?

CVE-2025-69263 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Node.js are affected by CVE-2025-69263?

Organizations using pnpm face notable risk from CVE-2025-69263 rated CVSS 7.5. Exploitation could compromise the security of affected deployments.. A patch is available.

Is there a public PoC exploit available for CVE-2025-69263?

Yes, a public proof-of-concept exploit is available for CVE-2025-69263. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-69263?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Vendor patch is available.

Node.js CVE-2025-69263

HIGH

Download of Code Without Integrity Check (CWE-494)

2026-01-07 security-advisories@github.com

GHSA-7vhp-vf5g-r2fw

Node.js Pnpm Red Hat Suse

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Red Hat

7.5 HIGH

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Jan 12, 2026 - 21:52 vuln.today

Public exploit code

Patch released

Jan 12, 2026 - 21:52 nvd

Patch available

CVE Published

Jan 07, 2026 - 22:15 nvd

HIGH 7.5

DescriptionGitHub Advisory

pnpm is a package manager. Versions 10.26.2 and below store HTTP tarball dependencies (and git-hosted tarballs) in the lockfile without integrity hashes. This allows the remote server to serve different content on each install, even when a lockfile is committed. An attacker who publishes a package with an HTTP tarball dependency can serve different code to different users or CI/CD environments. The attack requires the victim to install a package that has an HTTP/git tarball in its dependency tree. The victim's lockfile provides no protection. This issue is fixed in version 10.26.0.

AnalysisAI

pnpm is a package manager. Versions 10.26.2 and below store HTTP tarball dependencies (and git-hosted tarballs) in the lockfile without integrity hashes. [CVSS 7.5 HIGH]

Technical ContextAI

Classified as CWE-494 (Download of Code Without Integrity Check). Affects Pnpm. pnpm is a package manager. Versions 10.26.2 and below store HTTP tarball dependencies (and git-hosted tarballs) in the lockfile without integrity hashes. This allows the remote server to serve different content on each install, even when a lockfile is committed. An attacker who publishes a package with an HTTP tarball dependency can serve different code to different users or CI/CD environments. The attack requires the victim to install a package that has an HTTP/git tarball in its dependency tre