CVE-2025-65025
published 2025-11-19CVE-2025-65025: esm.sh is a nobuild content delivery network(CDN) for modern web development. Prior to version 136, the esm.sh CDN service is vulnerable to path traversal…
PriorityP261critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.50%
38.9th percentile
esm.sh is a nobuild content delivery network(CDN) for modern web development. Prior to version 136, the esm.sh CDN service is vulnerable to path traversal during NPM package tarball extraction. An attacker can craft a malicious NPM package containing specially crafted file paths (e.g., package/../../tmp/evil.js). When esm.sh downloads and extracts this package, files may be written to arbitrary locations on the server, escaping the intended extraction directory. This issue has been patched in version 136.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| esm-dev | esm.sh | < 136 | 136 |
| esm | esm.sh | < 136 | 136 |
| github.com | esm-dev_esm.sh | >= 0 < 0.0.0-20251117232647-9d77b88c3207 | 0.0.0-20251117232647-9d77b88c3207 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
esm.sh CDN service has arbitrary file write via tarslip in github.com/esm-dev/esm.sh
osv·2025-11-25
CVE-2025-65025 esm.sh CDN service has arbitrary file write via tarslip in github.com/esm-dev/esm.sh
esm.sh CDN service has arbitrary file write via tarslip in github.com/esm-dev/esm.sh
esm.sh CDN service has arbitrary file write via tarslip in github.com/esm-dev/esm.sh
OSV
esm.sh CDN service has arbitrary file write via tarslip
osv·2025-11-19
CVE-2025-65025 [HIGH] esm.sh CDN service has arbitrary file write via tarslip
esm.sh CDN service has arbitrary file write via tarslip
### Summary
The esm.sh CDN service is vulnerable to a Path Traversal (CWE-22) vulnerability during NPM package tarball extraction.
An attacker can craft a malicious NPM package containing specially crafted file paths (e.g., `package/../../tmp/evil.js`).
When esm.sh downloads and extracts this package, files may be written to arbitrary locations on the server, escaping the intended extraction directory.
Uploading files containing `../` in the path is not allowed on official registries (npm, GitHub), but the `X-Npmrc` header allows specifying any arbitrary registry.
By setting the registry to an attacker-controlled server via the `X-Npmrc` header, this vulnerability can be triggered.
### Details
**file:** `server/npmrc.go`
**line:**
GHSA
esm.sh CDN service has arbitrary file write via tarslip
ghsa·2025-11-19
CVE-2025-65025 [HIGH] CWE-22 esm.sh CDN service has arbitrary file write via tarslip
esm.sh CDN service has arbitrary file write via tarslip
### Summary
The esm.sh CDN service is vulnerable to a Path Traversal (CWE-22) vulnerability during NPM package tarball extraction.
An attacker can craft a malicious NPM package containing specially crafted file paths (e.g., `package/../../tmp/evil.js`).
When esm.sh downloads and extracts this package, files may be written to arbitrary locations on the server, escaping the intended extraction directory.
Uploading files containing `../` in the path is not allowed on official registries (npm, GitHub), but the `X-Npmrc` header allows specifying any arbitrary registry.
By setting the registry to an attacker-controlled server via the `X-Npmrc` header, this vulnerability can be triggered.
### Details
**file:** `server/npmrc.go`
**line:**
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-11-19
Published