esm.sh CVE-2025-65026

Requires (1) the esm.sh ?module CSS-to-JavaScript conversion feature to be used, (2) attacker control over the CSS file content served - typically by publishing or compromising a package whose CSS contains a ${...} template-literal expression and no backtick character (the pre-patch code only JSON-escaped CSS that contained a backtick, leaving backtick-free CSS inserted raw), and (3) a victim application to import that CSS module (UI:R - the payload only fires on import). Limiting factors: exploitation is not a direct hit on the esm.sh service but depends on a victim choosing to import attacker-influenced CSS; impact severity depends on runtime - XSS in browsers versus full RCE in Electron; and only esm.sh versions prior to 136 are affected.

Signals conflict sharply. CVSS 3.1 is 9.6 Critical (AV:N/AC:L/PR:N/UI:R/S:C with full C/I/A impact) and a public exploit exists in the GHSA advisory, yet EPSS is only 0.03% (8th percentile) and the CVE is NOT in CISA KEV - status is 'publicly available exploit code exists' but not actively exploited. The low EPSS is consistent with the real-world exploitation path: this is not a direct remote hit against the esm.sh service itself, but a supply-chain-style injection requiring an attacker to get malicious CSS served (e.g. via a published package) AND a victim application to import that CSS module with ?module (UI:R). The scope change (S:C) and I:H/A:H are justified because injected code executes in the victim's context - ordinary XSS in browsers but full RCE in Electron apps, which is the genuinely dangerous case. Net: a high-impact, low-probability issue - a real priority for anyone running Electron apps that import untrusted esm.sh CSS modules, but unlikely to see mass automated exploitation, matching the low EPSS. The patch is confirmed available (commit 87d2f64) and the fix is simple (JSON-encode all CSS, not just backtick-containing CSS), so remediation is straightforward.

An attacker publishes (or compromises) a package whose CSS file contains a template-literal expression such as ${...}; when a victim app imports that CSS via esm.sh's ?module endpoint, esm.sh embeds the raw CSS into a JavaScript template literal and the ${...} payload executes in the victim's runtime. In a browser this yields XSS, and in an Electron application it yields remote code execution with the app's privileges. A public proof-of-concept is included in the GHSA advisory (GHSA-hcpf-qv9m-vfgp).