-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability is a template literal injection in the esm.sh CDN service, specifically within the feature that converts CSS to a JavaScript module. The provided description and the fixing commit 87d2f6497574bf4448641a5527a3ac2beba5fd6c clearly point to the esmRouter function in server/router.go as the location of the vulnerable code. The patch shows the removal of a code block that directly wrote CSS content into a JavaScript template literal without proper sanitization. The vulnerable code path was taken when the CSS content did not contain a backtick. An attacker could exploit this by crafting a CSS file containing a malicious JavaScript payload within a ${...} expression. The fix involves always JSON-encoding the CSS content before embedding it in the JavaScript response, thus neutralizing the injection vector. Therefore, esmRouter is the vulnerable function that would appear in a runtime profile during exploitation.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/esm-dev/esm.sh | go | < 0.0.0-20251118065157-87d2f6497574 | 0.0.0-20251118065157-87d2f6497574 |
A Semantic Attack on Google Gemini - Read the Latest Research