CVE-2025-65026 is a medium severity (CVSS 6.1) template literal injection in esm.sh, the no-build CDN. When a CSS file is requested as a module, its content is embedded in JavaScript without full escaping. That enables cross-site scripting in browsers. Update to version 136 or later.
What's affected
esm.sh before version 136 is affected, per the record. The GitHub advisory lists the Go module github.com/esm-dev/esm.sh with a patched pseudo-version of 0.0.0-20251118065157-87d2f6497574. As with the companion tarball flaw, both sources describe one fix in two version formats.
The feature involved is the CSS to JavaScript module conversion. When a CSS file is requested with the module query parameter, esm.sh wraps the CSS in a JavaScript module so it can be imported as a stylesheet. The advisory says the conversion checked for backtick characters but did not escape template expressions, so crafted content could run as JavaScript when a victim application imports the module.
Impact is rated Medium in both places, with a CVSS 3.1 score of 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). The advisory says this enables cross-site scripting in browsers and remote code execution in Electron applications.
How to check if you're exposed
There are two groups to check. Operators of an esm.sh server should confirm the version or commit they run is 136 or later, or includes commit 87d2f6497574 from the advisory.
Application teams should look for places where they import CSS from esm.sh as a module. A search of your source can find them:
grep -rn "esm.sh" src | grep -i "module"
Pay special attention to Electron applications, because the advisory calls out remote code execution there. Also check any internal tooling that loads styles from a CDN at run time.
What to do now
- If you run esm.sh, update to version 136 or later.
- Review where your applications import CSS modules from a CDN, and prefer content you control.
- For Electron applications, avoid loading remote code at run time, and keep Node integration off in windows that show remote content.
- Pin the module versions you import and review changes when you bump them.
- Add a content security policy to web applications to limit what inline scripts can do.
Why it matters
The advisory classifies this under CWE-79 (cross-site scripting) and CWE-94 (code injection). The root cause is an incomplete escape. The code handled one special character and missed the template expression syntax, so untrusted text became part of an executable string.
Loading code or styles from a CDN means trusting that CDN and the packages it serves. That trust is usually fine, but it should be a deliberate choice, and an inventory of what each app pulls in at run time helps. The record does not say this was exploited in the wild, and the KEV flag is false. The free Safeguard dependency scan can list the packages in a project and flag known CVEs, and the Gold directory keeps a page for each one.
Quick check
Why is this only medium while the other esm.sh flaw is high?
It needs a user to import the crafted module, and its integrity and confidentiality impact are rated low. The tarball flaw writes files on the server, which is a larger impact.
Is this the same issue as CVE-2025-65025?
No. Both were fixed around the same time in esm.sh, but they are different weaknesses in different code paths.
Sources
Last reviewed: 18 October 2026.
