CVE-2025-65025

HighCVSS 8.2

Published: 19/11/2025(UTC)Updated: 18/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.53%

44th percentile - higher than 44% of all known CVEs

Summary

The esm.sh CDN service prior to version 136 is vulnerable to path traversal during NPM package tarball extraction. An attacker can craft a malicious NPM package with specially crafted file paths such as package/../../tmp/evil.js, causing files to be written outside the intended extraction directory.

Risk Assessment

Arbitrary files may be written on the server, potentially leading to code execution or service integrity compromise.

Recommendation

Update esm.sh to version 136 or later, which contains the fix for this issue.

Other vulnerabilities in esm.sh

CVE-2025-65026Medium
esm.sh prior to version 136 contains a Template Literal Injection vulnerability (CWE-94) in its CSS-to-JavaScript conversion. Malicious JavaScript injected via ${...} expressions in CSS files executes when the module is imported, enabling XSS in browsers and RCE in Electron applications.

Original NVD description (English source)

esm.sh is a nobuild content delivery network(CDN) for modern web development. Prior to version 136, the esm.sh CDN service is vulnerable to path traversal during NPM package tarball extraction. An attacker can craft a malicious NPM package containing specially crafted file paths (e.g., package/../../tmp/evil.js). When esm.sh downloads and extracts this package, files may be written to arbitrary locations on the server, escaping the intended extraction directory. This issue has been patched in version 136.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS