CVE-2025-65025
📋 TL;DR
CVE-2025-65025 is a path traversal vulnerability in esm.sh CDN service that allows attackers to write files to arbitrary server locations during NPM package extraction. This affects all users of esm.sh versions prior to 136. An attacker can exploit this by uploading a malicious NPM package with crafted file paths.
💻 Affected Systems
- esm.sh CDN service
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through arbitrary file write leading to remote code execution, data exfiltration, or service disruption.
Likely Case
Unauthorized file writes to sensitive directories, potentially enabling further attacks or data manipulation.
If Mitigated
Limited impact if proper file system permissions and sandboxing prevent writes to critical locations.
🎯 Exploit Status
Exploitation requires uploading a malicious NPM package to esm.sh, which is publicly accessible.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 136
Vendor Advisory: https://github.com/esm-dev/esm.sh/security/advisories/GHSA-h3mw-4f23-gwpw
Restart Required: Yes
Instructions:
1. Update esm.sh to version 136 or later. 2. Restart the esm.sh service. 3. Verify the fix by checking the version and testing package extraction.
🔧 Temporary Workarounds
Temporary service disable
linuxDisable esm.sh service until patched to prevent exploitation.
systemctl stop esm.sh
service esm.sh stop
🧯 If You Can't Patch
- Implement strict file system permissions to limit write access to critical directories.
- Monitor for unusual file creation patterns in server logs and file systems.
🔍 How to Verify
Check if Vulnerable:
Check esm.sh version; if below 136, it is vulnerable.Check Version:
curl -s https://esm.sh/version or check service logs for version infoVerify Fix Applied:
Confirm esm.sh version is 136 or higher and test with a benign NPM package containing path traversal attempts.📡 Detection & Monitoring
Log Indicators:
- Unusual file write patterns outside expected directories
- Failed path traversal attempts in extraction logs
Network Indicators:
- Suspicious NPM package uploads to esm.sh endpoint
SIEM Query:
source="esm.sh" AND (event="file_write" AND path="*../*")