CVE-2025-65025
Last modified
CVE-2025-65025 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. esm.sh is a nobuild content delivery network(CDN) for modern web development. Prior to version 136, the esm.sh CDN service is vulnerable to path traversal during NPM package tarball extraction. EPSS estimates a 0.50% chance of exploitation in the next 30 days.
Description
esm.sh is a nobuild content delivery network(CDN) for modern web development. Prior to version 136, the esm.sh CDN service is vulnerable to path traversal during NPM package tarball extraction. An attacker can craft a malicious NPM package containing specially crafted file paths (e.g., package/../../tmp/evil.js). When esm.sh downloads and extracts this package, files may be written to arbitrary locations on the server, escaping the intended extraction directory. This issue has been patched in version 136.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Esm | Esm.Sh | < 136 |
References
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2025-65025?
How severe is CVE-2025-65025?
How do I fix CVE-2025-65025?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-6502A vulnerability has been found in code-projects Inventory Ma…9.8
- CVE-2025-65020Rallly is an open-source scheduling and collaboration tool. …6.5
- CVE-2025-65021Rallly is an open-source scheduling and collaboration tool. …9.1
- CVE-2025-65022i-Educar is free, fully online school management software. I…7.2
- CVE-2025-65023i-Educar is free, fully online school management software. I…7.2
- CVE-2025-65024i-Educar is free, fully online school management software. I…7.2
- CVE-2025-65026esm.sh is a nobuild content delivery network(CDN) for modern…9.6
- CVE-2025-65027RomM (ROM Manager) allows users to scan, enrich, browse and …7.6
- CVE-2025-65028Rallly is an open-source scheduling and collaboration tool. …6.5
- CVE-2025-65029Rallly is an open-source scheduling and collaboration tool. …8.1
- CVE-2025-6503A vulnerability was found in code-projects Inventory Managem…9.8
- CVE-2025-65030Rallly is an open-source scheduling and collaboration tool. …7.1
Are you affected by CVE-2025-65025?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST