https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-09T15:34:04.228419+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2025-65025 CVE-2025-65025 — esm.sh CDN service has arbitrary file write via tarslip 2026-10-09T15:34:04.244618+00:00

Affected: esm-dev esm.sh

esm.sh is a nobuild content delivery network(CDN) for modern web development. Prior to version 136, the esm.sh CDN service is vulnerable to path traversal during NPM package tarball extraction. An attacker can craft a malicious NPM package containing specially crafted file paths (e.g., package/../../tmp/evil.js). When esm.sh downloads and extracts this package, files may be written to arbitrary locations on the server, escaping the intended extraction directory. This issue has been patched in version 136.