esm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScript

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2025-65026 · Microsoft / collected KEV context

EUVD-2025-198180

GHSA-hcpf-qv9m-vfgp

GO-2025-4139

cve-program · CVE-2025-65026

• https://github.com/esm-dev/esm.sh/security/advisories/GHSA-hcpf-qv9m-vfgp
• https://github.com/esm-dev/esm.sh/commit/87d2f6497574bf4448641a5527a3ac2beba5fd6c

euvd · EUVD-2025-198180

• https://github.com/esm-dev/esm.sh/security/advisories/GHSA-hcpf-qv9m-vfgp
• https://github.com/esm-dev/esm.sh/commit/87d2f6497574bf4448641a5527a3ac2beba5fd6c

nvd · CVE-2025-65026

• https://github.com/esm-dev/esm.sh/commit/87d2f6497574bf4448641a5527a3ac2beba5fd6c
• https://github.com/esm-dev/esm.sh/security/advisories/GHSA-hcpf-qv9m-vfgp

osv · GHSA-hcpf-qv9m-vfgp

• https://github.com/esm-dev/esm.sh/security/advisories/GHSA-hcpf-qv9m-vfgp
• https://nvd.nist.gov/vuln/detail/CVE-2025-65026
• https://github.com/esm-dev/esm.sh/commit/87d2f6497574bf4448641a5527a3ac2beba5fd6c
• https://github.com/esm-dev/esm.sh

osv · GO-2025-4139

• https://github.com/esm-dev/esm.sh/security/advisories/GHSA-hcpf-qv9m-vfgp
• https://nvd.nist.gov/vuln/detail/CVE-2025-65026
• https://github.com/esm-dev/esm.sh/commit/87d2f6497574bf4448641a5527a3ac2beba5fd6c

No related operational record is retained in the current change model.