PT-2025-47504 · Esm.Sh · Esm.Sh

Published 2025-11-19 · Updated 2025-12-15 · CVE-2025-65026

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions esm.sh versions prior to 136

Description The esm.sh CDN service has an issue where CSS-to-JavaScript module conversion lacks proper sanitization. When a CSS file is requested with the ?module parameter, it is converted to a JavaScript module, embedding the CSS content into a template literal. An attacker can inject malicious JavaScript code using ${...} expressions within CSS files. This can lead to Cross-Site Scripting (XSS) in browsers and Remote Code Execution (RCE) in Electron applications. The vulnerable feature is the conversion of CSS files to JavaScript modules.

Recommendations Update to version 136 or later.

Exploit

Fix

RCE

Code Injection

XSS

Weakness Enumeration

CWE-94

CWE-79

Related Identifiers

CVE-2025-65026

GHSA-HCPF-QV9M-VFGP

GO-2025-4139

SUSE-SU-2025:4395-1

Affected Products

Esm.Sh

References · 51

• 🔥 https://github.com/esm-dev/esm.sh/security/advisories/GHSA-hcpf-qv9m-vfgp · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65026.json · Exploit
• https://github.com/esm-dev/esm.sh/commit/87d2f6497574bf4448641a5527a3ac2beba5fd6c · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:4395-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-hcpf-qv9m-vfgp · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-4139 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-65026 · Security Note
• https://osv.dev/vulnerability/CVE-2025-65026 · Vendor Advisory
• https://github.com/esm-dev/esm.sh · Note
• https://twitter.com/VulmonFeeds/status/1991266161019728026 · Twitter Post
• https://suse.com/security/cve/CVE-2025-41115 · Note
• https://suse.com/security/cve/CVE-2025-55074 · Note
• https://suse.com/support/update/announcement/2025/suse-su-20254395-1 · Note
• https://reddit.com/r/VulnMatter/comments/1p2foxr/resumen_diario_de_vulnerabilidades_20112025 · Reddit Post
• https://suse.com/security/cve/CVE-2025-44005 · Note