Executive brief
esm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScript in github.com/esm-dev/esm.sh
Affected products
- Go github.com/esm-dev/esm.sh
Junglewise Threat Intelligence
CVE-2025-65026: GO-2025-4139 - esm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScript in github.com/esm-dev/esm.sh
CVE-2025-65026 · Severity: low · CVSS 3.1 · Published 2025-11-25
Technologies: github.com/esm-dev/esm.sh (Go). Vendors: Go.
Related threats
- esm-dev esm.sh path traversal in package.json browser field
- esm.sh path traversal in legacy router leads to arbitrary file write
- GO-2026-4554 - esm.sh has SSRF localhost/private-network bypass in `/http(s)` module route in github.com/esm-dev/esm.sh
- GO-2026-4332 - esm.sh has a path traversal in extractPackageTarball enables file writes from malicious packages
- GO-2026-4545 - esm.sh is vulnerable to full-response SSRF in github.com/esm-dev/esm.sh