CVE-2025-65026: esm-dev esm.sh Code Injection

Vulnerability summary

CVE-2025-65026 is a critical (CVSS 9.6) Code Injection vulnerability in esm-dev esm.sh. EPSS estimates a 0.48% chance of exploitation in the next 30 days, higher than 40% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 19-11-2025
   PublishedVulnerability first disclosed.
2. 20-11-2025
   Last modifiedVulnerability information updated.

Description

esm.sh is a nobuild content delivery network(CDN) for modern web development. Prior to version 136, The esm.sh CDN service contains a Template Literal Injection vulnerability (CWE-94) in its CSS-to-JavaScript module conversion feature. When a CSS file is requested with the ?module query parameter, esm.sh converts it to a JavaScript module by embedding the CSS content directly into a template literal without proper sanitization. An attacker can inject malicious JavaScript code using ${...} expressions within CSS files, which will execute when the module is imported by victim applications. This enables Cross-Site Scripting (XSS) in browsers and Remote Code Execution (RCE) in Electron applications. This issue has been patched in version 136.

• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
• CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.