CVE-2025-65025

esm.sh is a nobuild content delivery network(CDN) for modern web development. Prior to version 136, the esm.sh CDN service is vulnerable to path traversal during NPM package tarball extraction. An attacker can craft a malicious NPM package containing specially crafted file paths (e.g., package/../../tmp/evil.js). When esm.sh downloads and extracts this package, files may be written to arbitrary locations on the server, escaping the intended extraction directory. This issue has been patched in version 136.

CVSS v3 8.2 HIGH

8.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 4.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/esm-dev/esm.sh/commit/9d77b88c320733ff6689d938d85d246a3af9af16	Patch
https://github.com/esm-dev/esm.sh/security/advisories/GHSA-h3mw-4f23-gwpw	Exploit Vendor Advisory
https://github.com/esm-dev/esm.sh/security/advisories/GHSA-h3mw-4f23-gwpw	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:esm:esm.sh:*:*:*:*:*:*:*:*

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) esm.sh es una red de entrega de contenido (CDN) sin compilación para el desarrollo web moderno. Versiones anteriores a la versión 136, el servicio CDN esm.sh es vulnerable a salto de ruta durante la extracción de tarballs de paquetes NPM. Un atacante puede crear un paquete NPM malicioso que contenga rutas de archivo especialmente diseñadas (por ejemplo, package/.. / ../tmp/evil.js). Cuando esm.sh descarga y extrae este paquete, los archivos pueden escribirse en ubicaciones arbitrarias en el servidor, escapando del directorio de extracción previsto. Este problema ha sido parcheado en la versión 136.

Information

Published : 2025-11-19 18:15

Updated : 2026-10-18 20:10

NVD link : CVE-2025-65025

Mitre link : CVE-2025-65025

CVE.ORG link : CVE-2025-65025

JSON object : View

Products Affected

esm

esm.sh

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2025-65025", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-65025", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-20T14:09:39.459957Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 4.2, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "esm-dev", "product": "esm.sh", "versions": [{"status": "affected", "version": "< 136"}]}]}], "published": "2025-11-19T18:15:49.840", "references": [{"url": "https://github.com/esm-dev/esm.sh/commit/9d77b88c320733ff6689d938d85d246a3af9af16", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/esm-dev/esm.sh/security/advisories/GHSA-h3mw-4f23-gwpw", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/esm-dev/esm.sh/security/advisories/GHSA-h3mw-4f23-gwpw", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "esm.sh is a nobuild content delivery network(CDN) for modern web development. Prior to version 136, the esm.sh CDN service is vulnerable to path traversal during NPM package tarball extraction. An attacker can craft a malicious NPM package containing specially crafted file paths (e.g., package/../../tmp/evil.js). When esm.sh downloads and extracts this package, files may be written to arbitrary locations on the server, escaping the intended extraction directory. This issue has been patched in version 136."}, {"lang": "es", "value": "esm.sh es una red de entrega de contenido (CDN) sin compilaci\u00f3n para el desarrollo web moderno. Versiones anteriores a la versi\u00f3n 136, el servicio CDN esm.sh es vulnerable a salto de ruta durante la extracci\u00f3n de tarballs de paquetes NPM. Un atacante puede crear un paquete NPM malicioso que contenga rutas de archivo especialmente dise\u00f1adas (por ejemplo, package/.. / ../tmp/evil.js). Cuando esm.sh descarga y extrae este paquete, los archivos pueden escribirse en ubicaciones arbitrarias en el servidor, escapando del directorio de extracci\u00f3n previsto. Este problema ha sido parcheado en la versi\u00f3n 136."}], "lastModified": "2026-10-18T20:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:esm:esm.sh:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6FB0321A-8476-4667-8F8F-BF9D9E1DF466", "versionEndExcluding": "136"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}