{"id":"EUVD-2025-198181","enisaUuid":"49c70a2b-1576-343d-84b7-74aaa55d7858","description":"esm.sh is a nobuild content delivery network(CDN) for modern web development. Prior to version 136, the esm.sh CDN service is vulnerable to path traversal during NPM package tarball extraction. An attacker can craft a malicious NPM package containing specially crafted file paths (e.g., package/../../tmp/evil.js). When esm.sh downloads and extracts this package, files may be written to arbitrary locations on the server, escaping the intended extraction directory. This issue has been patched in version 136.","datePublished":"Nov 19, 2025, 5:32:46 PM","dateUpdated":"Nov 20, 2025, 2:09:44 PM","baseScore":8.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","references":"https://github.com/esm-dev/esm.sh/security/advisories/GHSA-h3mw-4f23-gwpw\nhttps://github.com/esm-dev/esm.sh/commit/9d77b88c320733ff6689d938d85d246a3af9af16\n","aliases":"CVE-2025-65025\nGHSA-h3mw-4f23-gwpw\n","assigner":"GitHub_M","epss":0.57,"enisaIdProduct":[{"id":"8ab644ba-11ee-35e7-ac22-46cec6967c2a","product":{"name":"esm.sh","vendor":{"name":"esm-dev"}},"product_version":"\u003c 136"}],"enisaIdVendor":[{"id":"39431d88-a456-349d-b95a-9c3a4af58cad","vendor":{"name":"esm-dev"}}],"enisaIdVulnerability":[{"id":"09e66f84-a25d-3965-b88e-aab18393d16a","vulnerability":{"id":"GHSA-h3mw-4f23-gwpw","description":"esm.sh CDN service has arbitrary file write via tarslip","datePublished":"Nov 19, 2025, 8:30:00 PM","dateUpdated":"Nov 27, 2025, 8:29:22 AM","baseScore":0.0,"references":"https://github.com/esm-dev/esm.sh/security/advisories/GHSA-h3mw-4f23-gwpw\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-65025\nhttps://github.com/esm-dev/esm.sh/commit/9d77b88c320733ff6689d938d85d246a3af9af16\nhttps://github.com/esm-dev/esm.sh\n","enisa_id":"EUVD-2025-198181\n","aliases":"CVE-2025-65025\nGHSA-h3mw-4f23-gwpw\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:56:19 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"1b4a6620-c92d-3902-bf05-d09b7a9749de","vulnerability":{"id":"CVE-2025-65025","description":"esm.sh is a nobuild content delivery network(CDN) for modern web development. Prior to version 136, the esm.sh CDN service is vulnerable to path traversal during NPM package tarball extraction. An attacker can craft a malicious NPM package containing specially crafted file paths (e.g., package/../../tmp/evil.js). When esm.sh downloads and extracts this package, files may be written to arbitrary locations on the server, escaping the intended extraction directory. This issue has been patched in version 136.","datePublished":"Nov 19, 2025, 5:32:46 PM","dateUpdated":"Nov 20, 2025, 2:09:44 PM","status":"PUBLISHED","baseScore":8.2,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","references":"https://github.com/esm-dev/esm.sh/security/advisories/GHSA-h3mw-4f23-gwpw\nhttps://github.com/esm-dev/esm.sh/commit/9d77b88c320733ff6689d938d85d246a3af9af16\n","enisa_id":"EUVD-2025-198181\n","assigner":"GitHub_M","epss":0.57,"dataProcessed":"Nov 6, 2026, 7:20:59 AM","vulnerabilityProduct":[{"id":"01c3b199-b147-3c3d-980d-197748fbf4b8","product":{"name":"esm.sh","vendor":{"name":"esm-dev"}},"product_version":"\u003c 136"}],"vulnerabilityVendor":[{"id":"822fa734-9e66-3ea0-b48b-a42eae60eabd","vendor":{"name":"esm-dev"}}]}}],"enisaIdAdvisory":[]}