CVE-2025-65026
📋 TL;DR
CVE-2025-65026 is a template literal injection vulnerability in esm.sh's CSS-to-JavaScript conversion feature that allows attackers to inject malicious JavaScript code via CSS files. When exploited, this enables Cross-Site Scripting (XSS) in web browsers and Remote Code Execution (RCE) in Electron applications. Anyone using esm.sh versions before 136 to serve CSS files with the ?module parameter is affected.
💻 Affected Systems
- esm.sh CDN service
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full remote code execution in Electron applications, allowing complete system compromise and data exfiltration.
Likely Case
Cross-site scripting attacks in web browsers, enabling session hijacking, credential theft, and client-side attacks.
If Mitigated
Limited impact with proper content security policies and input validation in place.
🎯 Exploit Status
Exploitation requires attacker to control or inject malicious CSS content that gets processed by esm.sh.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 136
Vendor Advisory: https://github.com/esm-dev/esm.sh/security/advisories/GHSA-hcpf-qv9m-vfgp
Restart Required: No
Instructions:
1. Update esm.sh to version 136 or later. 2. If using self-hosted esm.sh, pull latest code and redeploy. 3. Clear any cached CSS modules from CDN.
🔧 Temporary Workarounds
Disable CSS module conversion
allAvoid using ?module parameter for CSS files to prevent template literal injection.
Implement CSP headers
allAdd strict Content Security Policy headers to limit script execution.
Content-Security-Policy: script-src 'self'
🧯 If You Can't Patch
- Implement strict input validation and sanitization for CSS content before processing.
- Use alternative CDN services or serve CSS files directly without esm.sh conversion.
🔍 How to Verify
Check if Vulnerable:
Check if esm.sh version is below 136 and if CSS files are served with ?module parameter.Check Version:
Check esm.sh response headers or API endpoint for version information.Verify Fix Applied:
Confirm esm.sh version is 136 or higher and test CSS module conversion with malicious payloads.📡 Detection & Monitoring
Log Indicators:
- Unusual CSS file requests with template literal patterns
- Multiple failed injection attempts
Network Indicators:
- HTTP requests to esm.sh with CSS files containing ${...} patterns
- Unexpected JavaScript execution from CSS modules
SIEM Query:
source="esm.sh" AND (uri="*.css?module" OR body="${*}")