CVE-2025-65025 - CVE House
Back to Database
Status published High CVE-2025-65025

esm.sh CDN service has arbitrary file write via tarslip

Vulnerability Description

esm.sh is a nobuild content delivery network(CDN) for modern web development. Prior to version 136, the esm.sh CDN service is vulnerable to path traversal during NPM package tarball extraction. An attacker can craft a malicious NPM package containing specially crafted file paths (e.g., package/../../tmp/evil.js). When esm.sh downloads and extracts this package, files may be written to arbitrary locations on the server, escaping the intended extraction directory. This issue has been patched in version 136.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-65025

Credits & Attribution

No credits recorded in the NVD database.

References

More from esm-dev

View All →
CVE-2025-65026
esm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScript
Medium 6.1
CVE-2025-59342
esm.sh writes arbitrary files via path traversal in `X-Zone-Id` header
Medium 5.5
CVE-2025-59341
Local File Inclusion in esm.sh
High 7.7
CVE-2025-50180
esm.sh is vulnerable to full-response SSRF
High 8.7

Affected Vendor

Affected Software

esm.sh
Vulnerable Versions:
< 136

Timeline

Official Publish: November 19th, 2025
Last Modified: November 20th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Weaknesses (CWE)

CWE-22

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1005 Data from Local System
Collection
T1552 Unsecured Credentials
Credential Access
T1565.001 Stored Data Manipulation
Impact