sm.sh is a nobuild content delivery network(CDN) for modern web development. Prior to version 136, the esm.sh CDN service is vulnerable to path traversal during NPM package tarball extraction. An attacker can craft a malicious NPM package containing specially crafted file paths (e.g., package/../../tmp/evil.js). When esm.sh downloads and extracts this package, files may be written to arbitrary locations on the server, escaping the intended extraction directory. This issue has been patched in version 136.
| Link | Resource |
|---|---|
| https://github.com/esm-dev/esm.sh/commit/9d77b88c320733ff6689d938d85d246a3af9af16 | Patch |
| https://github.com/esm-dev/esm.sh/security/advisories/GHSA-h3mw-4f23-gwpw | Exploit Vendor Advisory |
| https://github.com/esm-dev/esm.sh/security/advisories/GHSA-h3mw-4f23-gwpw | Exploit Vendor Advisory |
15 Jan 2026, 17:52
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Esm esm.sh
Esm |
|
| CPE | cpe:2.3:a:esm:esm.sh:*:*:*:*:*:*:*:* | |
| References | () https://github.com/esm-dev/esm.sh/commit/9d77b88c320733ff6689d938d85d246a3af9af16 - Patch | |
| References | () https://github.com/esm-dev/esm.sh/security/advisories/GHSA-h3mw-4f23-gwpw - Exploit, Vendor Advisory |
20 Nov 2025, 15:17
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/esm-dev/esm.sh/security/advisories/GHSA-h3mw-4f23-gwpw - |
19 Nov 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Published : 2025-11-19 18:15
Updated : 2026-01-15 17:52
NVD link : CVE-2025-65025
Mitre link : CVE-2025-65025
CVE.ORG link : CVE-2025-65025
JSON object : View
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')