{"id":"CVE-2025-65026","revision":"5e59d2f79f4b4724b4b1b475f3917c2e","records":[{"revision":"5e59d2f79f4b4724b4b1b475f3917c2e","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-65026","aliases":[],"title":"esm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScript","description":"esm.sh is a nobuild content delivery network(CDN) for modern web development. Prior to version 136, The esm.sh CDN service contains a Template Literal Injection vulnerability (CWE-94) in its CSS-to-JavaScript module conversion feature. When a CSS file is requested with the ?module query parameter, esm.sh converts it to a JavaScript module by embedding the CSS content directly into a template literal without proper sanitization. An attacker can inject malicious JavaScript code using ${...} expressions within CSS files, which will execute when the module is imported by victim applications. This enables Cross-Site Scripting (XSS) in browsers and Remote Code Execution (RCE) in Electron applications. This issue has been patched in version 136.","state":0,"publishedAt":"2025-11-19T17:33:11.469+00:00","modifiedAt":"2025-11-20T14:19:17.852+00:00","affected":[{"ecosystem":"Vendor product","name":"esm.sh","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"esm-dev\",\n                    \"product\": \"esm.sh\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 136\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","score":6.1,"severity":"MEDIUM"}],"references":["https://github.com/esm-dev/esm.sh/security/advisories/GHSA-hcpf-qv9m-vfgp","https://github.com/esm-dev/esm.sh/commit/87d2f6497574bf4448641a5527a3ac2beba5fd6c"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-65026","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-65026","identifiers":["CVE-2025-65026"]},"retained":false,"historicalAffected":[]}],"coverage":[]}