CVE-2025-65025 is a high severity (CVSS 8.2) path traversal in esm.sh, a no-build CDN for modern web development. Before version 136, extracting an npm package tarball could write files outside the intended directory on the server. The fix is in version 136, so self-hosted operators should update.
What's affected
esm.sh before version 136 is affected, according to the record. The GitHub advisory lists the Go module github.com/esm-dev/esm.sh and gives the patched version as a Go pseudo-version, 0.0.0-20251117232647-9d77b88c3207, which corresponds to the fix commit. The two sources describe the same fix in different version formats, so use whichever matches how you deploy.
This matters most to people who run their own esm.sh server. If you only import modules from the public esm.sh service, the server side of this flaw is the operator's concern, not yours.
The record scores it CVSS 3.1 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N), and the advisory also says High with 8.2. The description says an attacker can craft an npm package whose tarball holds file paths that climb out of the extraction directory, so that files are written to arbitrary locations on the server.
How to check if you're exposed
If you operate esm.sh, find the version or commit you deploy. For a Go build from source, check the commit in your checkout:
git -C /path/to/esm.sh log -1 --format=%H
Compare it with the fix commit 9d77b88c3207 listed in the advisory. For a release binary or a container image, check the tag against version 136.
The advisory explains that official registries reject such paths, but a request header that selects a custom registry can point the server at one that does not. So review whether your instance allows clients to choose the registry, and which network paths the server can reach. Also check the file system for unexpected files outside the package store, owned by the esm.sh service account.
What to do now
- Update your esm.sh deployment to version 136 or later, or to a build that includes the fix commit.
- Run the service as an unprivileged user with write access only to its own data directory.
- Restrict which registries the server may talk to, and restrict outbound network access.
- Look for files written outside the intended directories and review recent package fetches in your logs.
- If you are only a consumer of the public service, pin the module versions you import and keep an inventory of them.
Why it matters
Path traversal (CWE-22) is a classic. The code joins a base directory with a name taken from the archive and then trusts the result. If the name contains parent directory markers, the joined path leaves the base. Tarball extraction is a well known place for this, sometimes called tar slip, so any tool that unpacks third party archives needs an explicit check that every output path stays inside the target.
A CDN that builds packages on demand is a supply chain component. It takes content from outside, processes it and serves it to many sites, so a server-side write flaw there deserves attention. The record does not say this was exploited in the wild, and the KEV flag is false. The free Safeguard dependency scan can list the packages in a project and flag known CVEs, and the Gold directory keeps a page for each one.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Does this affect sites that import from esm.sh?
The flaw is in the server's tarball extraction, so the direct risk is to whoever runs the server. Users of the public service depend on its operators to have patched.
Why are there two different version numbers for the fix?
The record says version 136. The advisory uses a Go pseudo-version for the same commit. They describe the same fix.
Sources
Last reviewed: 18 October 2026.
