CVE-2025-65025: high-severity vulnerability in esm-dev esm.sh
esm.sh CDN service has arbitrary file write via tarslip
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.2epss 0.6%
esm.sh is a nobuild content delivery network(CDN) for modern web development. Prior to version 136, the esm.sh CDN service is vulnerable to path traversal during NPM package tarball extraction. An attacker can craft a malicious NPM package containing specially crafted file paths (e.g., package/../../tmp/evil.js). When esm.sh downloads and extracts this package, files may be written to arbitrary locations on the server, escaping the intended extraction directory. This issue has been patched in version 136.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Affected products
esm-dev · esm.shRelated CVEs — esm-dev esm.sh
In the same product, most dangerous first.
CVE-2025-59342MEDIUMesm.sh writes arbitrary files via path traversal in `X-Zone-Id` headerEPSS 3.2%CVE-2025-59341HIGHLocal File Inclusion in esm.shEPSS 1.6%CVE-2026-102657HIGHesm.sh: web.NewHandler allows arbitrary file read via encoded dot-segment path traversalEPSS 0.7%CVE-2026-23644HIGHesm.sh has path traversal in `extractPackageTarball` that enables file writes from malicious packagesEPSS 0.6%CVE-2025-65026MEDIUMesm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScriptEPSS 0.5%CVE-2026-44593HIGHesm.sh: Legacy Route Path Traversal Can Lead to RCEEPSS 0.4%