CVE-2025-65025 json
esm.sh CDN service has arbitrary file write via tarslip
published 2025-11-19 11 mo ago modified 2026-10-18 21 d ago also GHSA-h3mw-4f23-gwpw , GO-2025-4138 , EUVD-2025-198181
- cvss
- 8.2
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 47%
- public exploits
- 0
- none known
Summary
esm.sh is a nobuild content delivery network(CDN) for modern web development. Prior to version 136, the esm.sh CDN service is vulnerable to path traversal during NPM package tarball extraction. An attacker can craft a malicious NPM package containing specially crafted file paths (e.g., package/../../tmp/evil.js). When esm.sh downloads and extracts this package, files may be written to arbitrary locations on the server, escaping the intended extraction directory. This issue has been patched in version 136.
Patch / fix
- go github.com/esm-dev/esm.sh 0.0.0-20251117232647-9d77b88c3207
- esm esm.sh 136
- govulncheck-vulndb SLE Module for Package Hub 15 SP6, openSUSE Leap 15.6 0.0.20251209T172047-150000.1.127.1
suse advisories SUSE-SU-2025:4395-1
- govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
opensuse advisories openSUSE-SU-2026:21483-1
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 11 mo ago
Exploit prediction
0.57% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/esm-dev/esm.sh/security/advisories/GHSA-h3mw-4f23-gwpw referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/esm-dev/esm.sh | <0.0.0-20251117232647-9d77b88c3207 |
0.0.0-20251117232647-9d77b88c3207 |
Affected products
- esm-dev esm.sh
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
github.com
/esm-dev/esm.sh/commit/9d77b88c320733ff6689d938d85d246a3af9af16
web, patch
-
github.com
/esm-dev/esm.sh/security/advisories/GHSA-h3mw-4f23-gwpw
exploit, web, vendor-advisory, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-65025
advisory
-
github.com
/esm-dev/esm.sh
package
Sources
- CVE List CVE-2025-65025
- GitHub Advisory GHSA-h3mw-4f23-gwpw
- NVD CVE-2025-65025
- OSV GO-2025-4138
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.