CVE-2025-65025

Description

esm.sh CDN service has arbitrary file write via tarslip in github.com/esm-dev/esm.sh

Affected packages (2)

• Go/github.com/esm-dev/esm.shfrom 0, < 0.0.0-20251117232647-9d77b88c3207
• Go/github.com/esm-dev/esm.shfrom 0, < 0.0.0-20251117232647-9d77b88c3207

CVSS scores

References (4)

• ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2025-65025
• PATCHhttps://github.com/esm-dev/esm.sh
• WEBhttps://github.com/esm-dev/esm.sh/commit/9d77b88c320733ff6689d938d85d246a3af9af16
• WEBhttps://github.com/esm-dev/esm.sh/security/advisories/GHSA-h3mw-4f23-gwpw