{"id":"CVE-2025-65026","aliases":["GHSA-hcpf-qv9m-vfgp","GO-2025-4139"],"url":"https://o3.security/vulnerability/CVE-2025-65026","summary":"esm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScript","details":"esm.sh is a nobuild content delivery network(CDN) for modern web development. Prior to version 136, The esm.sh CDN service contains a Template Literal Injection vulnerability (CWE-94) in its CSS-to-JavaScript module conversion feature. When a CSS file is requested with the ?module query parameter, esm.sh converts it to a JavaScript module by embedding the CSS content directly into a template literal without proper sanitization. An attacker can inject malicious JavaScript code using ${...} expressions within CSS files, which will execute when the module is imported by victim applications. This enables Cross-Site Scripting (XSS) in browsers and Remote Code Execution (RCE) in Electron applications. This issue has been patched in version 136.","published":"2025-11-19T17:33:11.469Z","modified":"2026-08-08T03:48:15.861061681Z","cvss":{"score":6.1,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/esm-dev/esm.sh","fixedVersion":"0.0.0-20251118065157-87d2f6497574"}],"fix":{"url":"https://github.com/esm-dev/esm.sh/commit/87d2f6497574bf4448641a5527a3ac2beba5fd6c","label":"esm-dev/esm.sh@87d2f64"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/65xxx/CVE-2025-65026.json"},{"type":"ADVISORY","url":"https://github.com/esm-dev/esm.sh/security/advisories/GHSA-hcpf-qv9m-vfgp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-65026"},{"type":"FIX","url":"https://github.com/esm-dev/esm.sh/commit/87d2f6497574bf4448641a5527a3ac2beba5fd6c"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-08T03:48:15.861061681Z"}}