Cloudanix VulnDB

CVE-2025-65026

Medium · 6.1

esm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScript

CVSS

6.1

EPSS

0.5%

Published

Nov 19, 2025

CISA due date

—

The record

The esm.sh CDN service contains a Template Literal Injection vulnerability (CWE-94) in its CSS-to-JavaScript module conversion feature. When a CSS file is requested with the `?module` query parameter, esm.sh converts it to a JavaScript module by embedding the CSS content directly into a template literal without proper sanitization. An attacker can inject malicious JavaScript code using `${...}` expressions within CSS files, which will execute when the module is imported by victim applications. This enables Cross-Site Scripting (XSS) in browsers and Remote Code Execution (RCE) in Electron applications. **Root Cause:** The CSS module conversion logic (`router.go:1112-1119`) performs incomplete sanitization - it only checks for backticks (\`) but fails to escape template literal expressions (`${...}`), allowing arbitrary JavaScript execution when the CSS content is inserted into a template literal string.

Affected packages

Ecosystem Package Introduced Fixed
Go github.com/esm-dev/esm.sh 0 0.0.0-20251118065157-87d2f6497574
SUSE:Linux Enterprise Module for Package Hub 15 SP6 govulncheck-vulndb 0 0.0.20251209T172047-150000.1.127.1
openSUSE:Leap 15.6 govulncheck-vulndb 0 0.0.20251209T172047-150000.1.127.1

Related vulnerabilities