CVE-2025-65026mediumCWE-94

CVE-2025-65026: medium-severity vulnerability in esm-dev esm.sh

esm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScript

Published · Updated

Follow this CVE+ Monitor esm.sh+ Monitor github.com/esm-dev/esm.sh

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.1epss 0.5%
esm.sh is a nobuild content delivery network(CDN) for modern web development. Prior to version 136, The esm.sh CDN service contains a Template Literal Injection vulnerability (CWE-94) in its CSS-to-JavaScript module conversion feature. When a CSS file is requested with the ?module query parameter, esm.sh converts it to a JavaScript module by embedding the CSS content directly into a template literal without proper sanitization. An attacker can inject malicious JavaScript code using ${...} expressions within CSS files, which will execute when the module is imported by victim applications. This enables Cross-Site Scripting (XSS) in browsers and Remote Code Execution (RCE) in Electron applications. This issue has been patched in version 136.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
esm-dev · esm.sh
Related CVEs — esm-dev esm.sh

In the same product, most dangerous first.

CVE-2025-59342MEDIUMesm.sh writes arbitrary files via path traversal in `X-Zone-Id` headerEPSS 3.2%CVE-2025-59341HIGHLocal File Inclusion in esm.shEPSS 1.6%CVE-2026-102657HIGHesm.sh: web.NewHandler allows arbitrary file read via encoded dot-segment path traversalEPSS 0.7%CVE-2025-65025HIGHesm.sh CDN service has arbitrary file write via tarslipEPSS 0.6%CVE-2026-23644HIGHesm.sh has path traversal in `extractPackageTarball` that enables file writes from malicious packagesEPSS 0.6%CVE-2026-44593HIGHesm.sh: Legacy Route Path Traversal Can Lead to RCEEPSS 0.4%