https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-01T21:00:12.363313+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2025-69263 CVE-2025-69263 — pnpm Lockfile Integrity Bypass Allows Remote Dynamic Dependencies 2026-10-01T21:00:12.791122+00:00

Affected: pnpm, Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack

pnpm is a package manager. Versions 10.26.2 and below store HTTP tarball dependencies (and git-hosted tarballs) in the lockfile without integrity hashes. This allows the remote server to serve different content on each install, even when a lockfile is committed. An attacker who publishes a package with an HTTP tarball dependency can serve different code to different users or CI/CD environments. The attack requires the victim to install a package that has an HTTP/git tarball in its dependency tree. The victim's lockfile provides no protection. This issue is fixed in version 10.26.0.

 https://vulnerability.circl.lu/vuln/ghsa-7vhp-vf5g-r2fw GHSA-7vhp-vf5g-r2fw — pnpm Has Lockfile Integrity Bypass that Allows Remote Dynamic Dependencies 2026-10-01T21:00:12.791320+00:00

Affected: npm: pnpm

### Summary

HTTP tarball dependencies (and git-hosted tarballs) are stored in the lockfile without integrity hashes. This allows the remote server to serve different content on each install, even when a lockfile is committed.

### Details

When a package depends on an HTTP tarball URL, pnpm's tarball resolver returns only the URL without computing an integrity hash:

`resolving/tarball-resolver/src/index.ts`: ```javascript return { resolution: { tarball: resolvedUrl, // No integrity field }, resolvedVia: 'url', } ```

The resulting lockfile entry has no integrity to verify: ```yaml remote-dynamic-dependency@http://example.com/pkg.tgz: resolution: {tarball: http://example.com/pkg.tgz} version: 1.0.0 ```

Since there is no integrity hash, pnpm cannot detect when the server returns different content.

This affects: - HTTP/HTTPS tarball URLs (`"pkg": "https://example.com/pkg.tgz"`) - Git shorthand dependencies (`"pkg": "github:user/repo"`) - Git URLs (`"pkg": "git+https://github.com/user/repo"`)

npm registry packages are not affected as they include integrity hashes from the registry metadata.

### PoC

See attached [pnpm-bypass-integrity-poc.zip](https://github.com/user-attachments/files/23819648/pnpm-bypass-integrity-poc.zip)

The POC includes: - A server that returns different tarball content on each request - A `malicious-package` that depends on the HTTP tarball - A `victim` project that depends on `malicious-package`

To run: ```bash cd pnpm-bypass-int…