esm.sh CVE-2025-65025

Exploitation requires the attacker to control the npm registry that esm.sh fetches from: the GHSA advisory states official registries (npm, GitHub) reject tarball entries containing '../', so the attacker must set the registry to an attacker-controlled server using the X-Npmrc request header and then serve a malicious tarball with traversal paths. A further limiting factor is esm.sh's extension allow-list in extractPackageTarball() - only files with permitted extensions (.js, .css, .json, etc.) are written, so the arbitrary-write primitive is constrained to those file types (which still permits dropping executable .js into sensitive locations). No user authentication is indicated (PR:N), and affected versions are all esm.sh prior to v136. The attack needs no victim interaction but does depend on the X-Npmrc header being honored by the target instance.

Signals conflict sharply. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, 9.8 Critical) and CWE-22 path traversal describe a remotely reachable, unauthenticated arbitrary file write, and a public PoC plus GHSA advisory (GHSA-h3mw-4f23-gwpw) confirm the technique is reproducible - publicly available exploit code exists. Against that, EPSS is only 0.05% (14th percentile) and the vulnerability is NOT in CISA KEV, indicating no observed widespread exploitation. The low EPSS is consistent with the real exploitation gatekeeper the advisory discloses: a straightforward attack requires the attacker to force esm.sh to pull a malicious tarball from an attacker-controlled registry via the X-Npmrc header, since official registries (npm, GitHub) reject paths containing '../'. This is a genuine high-priority issue for anyone running a self-hosted or public esm.sh instance below v136 - arbitrary file write with permissive network reachability is a plausible path to code execution - but the modest EPSS and absence of KEV suggest exploitation is currently opportunistic/targeted rather than mass-automated. The confidentiality impact rating (C:H) is somewhat generous for a primitive that is fundamentally a file write; impact is driven by integrity/availability and the realistic escalation to RCE, so treat C:H as inferred rather than direct.

An attacker sends a request to an esm.sh instance with an X-Npmrc header pointing the package registry to an attacker-controlled server, then serves a crafted npm tarball whose entries use paths like 'package/../../../../tmp/evil.js'. When esm.sh downloads and extracts the tarball via extractPackageTarball(), path.Join normalizes the traversal and writes the attacker's .js file outside the intended node_modules directory to an arbitrary server location. A working PoC (malicious tarball generator plus Flask registry server) is published in the GHSA advisory.