Template Literal Injection Vulnerability in esm.sh CDN Service

CVE-2025-65026

What is CVE-2025-65026?

The esm.sh CDN service is vulnerable to Template Literal Injection due to improper sanitization during CSS-to-JavaScript module conversion. When CSS files with the ?module query parameter are processed, the CDN embeds CSS content into JavaScript template literals without adequate validation. This flaw allows attackers to inject malicious JavaScript code via ${...} expressions in CSS files, leading to potential Cross-Site Scripting (XSS) attacks in web browsers and Remote Code Execution (RCE) in Electron-based applications. Vulnerability mitigation has been implemented in version 136.

References