{"id":"EUVD-2025-198180","enisaUuid":"2813f321-cf71-31f6-8d99-78f01b951334","description":"esm.sh is a nobuild content delivery network(CDN) for modern web development. Prior to version 136, The esm.sh CDN service contains a Template Literal Injection vulnerability (CWE-94) in its CSS-to-JavaScript module conversion feature. When a CSS file is requested with the ?module query parameter, esm.sh converts it to a JavaScript module by embedding the CSS content directly into a template literal without proper sanitization. An attacker can inject malicious JavaScript code using ${...} expressions within CSS files, which will execute when the module is imported by victim applications. This enables Cross-Site Scripting (XSS) in browsers and Remote Code Execution (RCE) in Electron applications. This issue has been patched in version 136.","datePublished":"Nov 19, 2025, 5:33:11 PM","dateUpdated":"Nov 20, 2025, 2:19:17 PM","baseScore":6.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","references":"https://github.com/esm-dev/esm.sh/security/advisories/GHSA-hcpf-qv9m-vfgp\nhttps://github.com/esm-dev/esm.sh/commit/87d2f6497574bf4448641a5527a3ac2beba5fd6c\n","aliases":"CVE-2025-65026\nGHSA-hcpf-qv9m-vfgp\n","assigner":"GitHub_M","epss":0.51,"enisaIdProduct":[{"id":"7ba57c68-d36b-3280-960e-fd3cb076f9c2","product":{"name":"esm.sh","vendor":{"name":"esm-dev"}},"product_version":"\u003c 136"}],"enisaIdVendor":[{"id":"e2093b16-9fed-3adf-99f7-b45f77a9f766","vendor":{"name":"esm-dev"}}],"enisaIdVulnerability":[{"id":"77189265-51ca-37fd-a2fa-1e00f5f358fd","vulnerability":{"id":"GHSA-hcpf-qv9m-vfgp","description":"esm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScript","datePublished":"Nov 19, 2025, 8:31:55 PM","dateUpdated":"Nov 27, 2025, 8:30:39 AM","baseScore":0.0,"references":"https://github.com/esm-dev/esm.sh/security/advisories/GHSA-hcpf-qv9m-vfgp\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-65026\nhttps://github.com/esm-dev/esm.sh/commit/87d2f6497574bf4448641a5527a3ac2beba5fd6c\nhttps://github.com/esm-dev/esm.sh\n","enisa_id":"EUVD-2025-198180\n","aliases":"CVE-2025-65026\nGHSA-hcpf-qv9m-vfgp\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:56:19 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"b0e9cc9f-dd0f-3b28-b418-3c77a5f90d33","vulnerability":{"id":"CVE-2025-65026","description":"esm.sh is a nobuild content delivery network(CDN) for modern web development. Prior to version 136, The esm.sh CDN service contains a Template Literal Injection vulnerability (CWE-94) in its CSS-to-JavaScript module conversion feature. When a CSS file is requested with the ?module query parameter, esm.sh converts it to a JavaScript module by embedding the CSS content directly into a template literal without proper sanitization. An attacker can inject malicious JavaScript code using ${...} expressions within CSS files, which will execute when the module is imported by victim applications. This enables Cross-Site Scripting (XSS) in browsers and Remote Code Execution (RCE) in Electron applications. This issue has been patched in version 136.","datePublished":"Nov 19, 2025, 5:33:11 PM","dateUpdated":"Nov 20, 2025, 2:19:17 PM","status":"PUBLISHED","baseScore":6.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","references":"https://github.com/esm-dev/esm.sh/security/advisories/GHSA-hcpf-qv9m-vfgp\nhttps://github.com/esm-dev/esm.sh/commit/87d2f6497574bf4448641a5527a3ac2beba5fd6c\n","enisa_id":"EUVD-2025-198180\n","assigner":"GitHub_M","epss":0.51,"dataProcessed":"Nov 6, 2026, 7:20:59 AM","vulnerabilityProduct":[{"id":"1c353f3b-389b-3f9a-af5a-e6b40bede564","product":{"name":"esm.sh","vendor":{"name":"esm-dev"}},"product_version":"\u003c 136"}],"vulnerabilityVendor":[{"id":"8f8393b7-5e0d-34ca-b0b5-a5e299c3e4c5","vendor":{"name":"esm-dev"}}]}}],"enisaIdAdvisory":[]}