CVE-2025-65026

esm.sh is a nobuild content delivery network(CDN) for modern web development. Prior to version 136, The esm.sh CDN service contains a Template Literal Injection vulnerability (CWE-94) in its CSS-to-JavaScript module conversion feature. When a CSS file is requested with the ?module query parameter, esm.sh converts it to a JavaScript module by embedding the CSS content directly into a template literal without proper sanitization. An attacker can inject malicious JavaScript code using ${...} expressions within CSS files, which will execute when the module is imported by victim applications. This enables Cross-Site Scripting (XSS) in browsers and Remote Code Execution (RCE) in Electron applications. This issue has been patched in version 136.

• CWE-94
• CWE-79

• https://github.com/esm-dev/esm.sh/commit/87d2f6497574bf4448641a5527a3ac2beba5fd6cPatch
• https://github.com/esm-dev/esm.sh/security/advisories/GHSA-hcpf-qv9m-vfgpExploit, Vendor Advisory
• https://github.com/esm-dev/esm.sh/security/advisories/GHSA-hcpf-qv9m-vfgpExploit, Vendor Advisory

Published

Nov 19, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-65020Rallly is an open-source scheduling and collaboration tool. …6.5
• CVE-2025-65021Rallly is an open-source scheduling and collaboration tool. …9.1
• CVE-2025-65022i-Educar is free, fully online school management software. I…7.2
• CVE-2025-65023i-Educar is free, fully online school management software. I…7.2
• CVE-2025-65024i-Educar is free, fully online school management software. I…7.2
• CVE-2025-65025esm.sh is a nobuild content delivery network(CDN) for modern…9.8
• CVE-2025-65027RomM (ROM Manager) allows users to scan, enrich, browse and …7.6
• CVE-2025-65028Rallly is an open-source scheduling and collaboration tool. …6.5
• CVE-2025-65029Rallly is an open-source scheduling and collaboration tool. …8.1
• CVE-2025-6503A vulnerability was found in code-projects Inventory Managem…9.8
• CVE-2025-65030Rallly is an open-source scheduling and collaboration tool. …7.1
• CVE-2025-65031Rallly is an open-source scheduling and collaboration tool. …6.5