CVE-2025-65026

MediumCVSS 6.1

Published: 19/11/2025(UTC)Updated: 18/10/2026(UTC)Translated: 19/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.48%

40th percentile - higher than 40% of all known CVEs

Summary

esm.sh prior to version 136 contains a Template Literal Injection vulnerability (CWE-94) in its CSS-to-JavaScript conversion. Malicious JavaScript injected via ${...} expressions in CSS files executes when the module is imported, enabling XSS in browsers and RCE in Electron applications.

Risk Assessment

Applications importing modules from esm.sh may be attacked via XSS or remote code execution, risking compromise of browsers or Electron apps.

Recommendation

Update esm.sh to version 136 or later.

Other vulnerabilities in esm.sh

CVE-2025-65025High
The esm.sh CDN service prior to version 136 is vulnerable to path traversal during NPM package tarball extraction. An attacker can craft a malicious NPM package with specially crafted file paths such as package/../../tmp/evil.js, causing files to be written outside the intended extraction directory.

Original NVD description (English source)

esm.sh is a nobuild content delivery network(CDN) for modern web development. Prior to version 136, The esm.sh CDN service contains a Template Literal Injection vulnerability (CWE-94) in its CSS-to-JavaScript module conversion feature. When a CSS file is requested with the ?module query parameter, esm.sh converts it to a JavaScript module by embedding the CSS content directly into a template literal without proper sanitization. An attacker can inject malicious JavaScript code using ${...} expressions within CSS files, which will execute when the module is imported by victim applications. This enables Cross-Site Scripting (XSS) in browsers and Remote Code Execution (RCE) in Electron applications. This issue has been patched in version 136.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS