PT-2025-47503 · Esm.Sh · Esm.Sh

Published 2025-11-19 · Updated 2025-12-15 · CVE-2025-65025

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions esm.sh versions prior to 136

Description The esm.sh CDN service is susceptible to a path traversal issue during the extraction of NPM package tarballs. An attacker can create a malicious NPM package with crafted file paths, such as package/../../tmp/evil.js. When esm.sh downloads and extracts this package, files can be written to locations outside the intended extraction directory, potentially allowing for arbitrary file writes on the server.

Recommendations Update to version 136 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-65025

GHSA-H3MW-4F23-GWPW

GO-2025-4138

SUSE-SU-2025:4395-1

Affected Products

Esm.Sh

References · 51

• 🔥 https://github.com/esm-dev/esm.sh/security/advisories/GHSA-h3mw-4f23-gwpw · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65025.json · Exploit
• https://github.com/esm-dev/esm.sh/commit/9d77b88c320733ff6689d938d85d246a3af9af16 · Patch
• https://osv.dev/vulnerability/GO-2025-4138 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-65025 · Security Note
• https://osv.dev/vulnerability/CVE-2025-65025 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:4395-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h3mw-4f23-gwpw · Vendor Advisory
• https://github.com/esm-dev/esm.sh · Note
• https://suse.com/security/cve/CVE-2025-41115 · Note
• https://suse.com/security/cve/CVE-2025-55074 · Note
• https://suse.com/support/update/announcement/2025/suse-su-20254395-1 · Note
• https://suse.com/security/cve/CVE-2025-44005 · Note
• https://suse.com/security/cve/CVE-2017-18870 · Note
• https://suse.com/security/cve/CVE-2025-13357 · Note