CVE-2025-65025: Arbitrary File Access in esm.sh CDN

The Arbitrary File Access vulnerability in esm.sh allows an attacker to write files to arbitrary locations on the server hosting the CDN. This is a critical risk because it bypasses typical access controls and allows for the injection of malicious code. An attacker could, for example, overwrite critical configuration files, inject malicious JavaScript into served assets, or even execute arbitrary commands on the server. The potential impact extends beyond the CDN itself, as compromised assets could then be served to a wide range of downstream consumers, leading to widespread compromise. The ability to write arbitrary files effectively grants the attacker a high degree of control over the affected system.

1. Reserved2025-11-13
2. Published2025-11-25
3. Modified2026-03-03
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-65025 is to immediately upgrade to version 0.0.0-20251117232647-9d77b88c3207 or later. If upgrading is not immediately feasible, consider implementing temporary workarounds such as restricting file write access within the esm.sh environment using file system permissions or access control lists. Web application firewalls (WAFs) configured to inspect and block requests containing suspicious file paths or payloads could also provide a layer of defense. Monitor CDN logs for unusual file write activity and investigate any anomalies. After upgrading, confirm the fix by attempting to trigger the vulnerability with a known payload and verifying that the write operation is denied.