{"id":"EUVD-2025-198181","revision":"96904ccf4d8347a187eed321f10132bd","records":[{"revision":"96904ccf4d8347a187eed321f10132bd","observedAt":"2026-11-01T01:13:55.461+00:00","statement":{"source":"euvd","id":"EUVD-2025-198181","aliases":["CVE-2025-65025","GHSA-h3mw-4f23-gwpw"],"title":"esm.sh is a nobuild content delivery network(CDN) for modern web development. Prior to version 136, the esm.sh CDN service is vulnerable to path traversal during NPM package tarball extraction. An attacker can craft a malicious NPM package …","description":"esm.sh is a nobuild content delivery network(CDN) for modern web development. Prior to version 136, the esm.sh CDN service is vulnerable to path traversal during NPM package tarball extraction. An attacker can craft a malicious NPM package containing specially crafted file paths (e.g., package/../../tmp/evil.js). When esm.sh downloads and extracts this package, files may be written to arbitrary locations on the server, escaping the intended extraction directory. This issue has been patched in version 136.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","score":8.2,"severity":null}],"references":["https://github.com/esm-dev/esm.sh/security/advisories/GHSA-h3mw-4f23-gwpw","https://github.com/esm-dev/esm.sh/commit/9d77b88c320733ff6689d938d85d246a3af9af16"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-198181","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Nov 19, 2025, 5:32:46 PM","dateUpdated":"Nov 20, 2025, 2:09:44 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-198181","identifiers":["EUVD-2025-198181","CVE-2025-65025","GHSA-h3mw-4f23-gwpw"]},"retained":false,"historicalAffected":[]}],"coverage":[]}