{"id":"CVE-2025-65026","sourceIdentifier":"security-advisories@github.com","published":"2025-11-19T18:15:50.023","lastModified":"2026-10-18T20:10:00.110","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"esm.sh is a nobuild content delivery network(CDN) for modern web development. Prior to version 136, The esm.sh CDN service contains a Template Literal Injection vulnerability (CWE-94) in its CSS-to-JavaScript module conversion feature. When a CSS file is requested with the ?module query parameter, esm.sh converts it to a JavaScript module by embedding the CSS content directly into a template literal without proper sanitization. An attacker can inject malicious JavaScript code using ${...} expressions within CSS files, which will execute when the module is imported by victim applications. This enables Cross-Site Scripting (XSS) in browsers and Remote Code Execution (RCE) in Electron applications. This issue has been patched in version 136."},{"lang":"es","value":"esm.sh es una red de entrega de contenido (CDN) sin compilación para el desarrollo web moderno. Versiones anteriores a la versión 136, el servicio CDN de esm.sh contiene una vulnerabilidad de inyección de literales de plantilla (CWE-94) en su función de conversión de módulos CSS a JavaScript. Cuando se solicita un archivo CSS con el parámetro de consulta ?module, esm.sh lo convierte en un módulo JavaScript incrustando el contenido CSS directamente en un literal de plantilla sin la sanitización adecuada. Un atacante puede inyectar código JavaScript malicioso utilizando expresiones ${...} dentro de archivos CSS, que se ejecutará cuando el módulo sea importado por las aplicaciones de la víctima. Esto permite Cross-Site Scripting (XSS) en navegadores y Ejecución Remota de Código (RCE) en aplicaciones Electron. Este problema ha sido parcheado en la versión 136."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"esm-dev","product":"esm.sh","versions":[{"version":"< 136","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","baseScore":9.6,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":2.8,"impactScore":6.0}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2025-11-20T14:19:05.465613Z","id":"CVE-2025-65026","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-79"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:esm:esm.sh:*:*:*:*:*:*:*:*","versionEndExcluding":"136","matchCriteriaId":"6FB0321A-8476-4667-8F8F-BF9D9E1DF466"}]}]}],"references":[{"url":"https://github.com/esm-dev/esm.sh/commit/87d2f6497574bf4448641a5527a3ac2beba5fd6c","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/esm-dev/esm.sh/security/advisories/GHSA-hcpf-qv9m-vfgp","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]},{"url":"https://github.com/esm-dev/esm.sh/security/advisories/GHSA-hcpf-qv9m-vfgp","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"]}]}