Esm.sh
Esm-Dev · 9 CVEs
CVE-2026-44594
HIGH
esm.sh: Path Traversal via package.json browser field allows reading arbitrary server files
May 28, 2026
CVE-2026-44593
HIGH
esm.sh: Legacy Route Path Traversal Can Lead to RCE
May 28, 2026
CVE-2026-27730
HIGH
esm.sh has SSRF localhost/private-network bypass in `/http(s)` module route
Feb 25, 2026
CVE-2025-50180
HIGH
esm.sh is vulnerable to full-response SSRF
Feb 25, 2026
CVE-2026-23644
HIGH
esm.sh has path traversal in `extractPackageTarball` that enables file writes from malicious packages
Jan 18, 2026
CVE-2025-65026
CRITICAL
esm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScript
Nov 19, 2025
CVE-2025-65025
CRITICAL
esm.sh CDN service has arbitrary file write via tarslip
Nov 19, 2025
CVE-2025-59342
MEDIUM
esm.sh writes arbitrary files via path traversal in `X-Zone-Id` header
Sep 17, 2025
CVE-2025-59341
HIGH
Local File Inclusion in esm.sh
Sep 17, 2025
| CVE ID | Description | Severity | EPSS | Published |
|---|---|---|---|---|
| CVE-2026-44594 | esm.sh: Path Traversal via package.json browser field allows reading arbitrary server files | HIGH | 0.48% | May 28, 2026 |
| CVE-2026-44593 | esm.sh: Legacy Route Path Traversal Can Lead to RCE | HIGH | 0.50% | May 28, 2026 |
| CVE-2026-27730 | esm.sh has SSRF localhost/private-network bypass in `/http(s)` module route | HIGH | 0.47% | Feb 25, 2026 |
| CVE-2025-50180 | esm.sh is vulnerable to full-response SSRF | HIGH | 0.39% | Feb 25, 2026 |
| CVE-2026-23644 | esm.sh has path traversal in `extractPackageTarball` that enables file writes from malicious packages | HIGH | 0.55% | Jan 18, 2026 |
| CVE-2025-65026 | esm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScript | CRITICAL | 0.48% | Nov 19, 2025 |
| CVE-2025-65025 | esm.sh CDN service has arbitrary file write via tarslip | CRITICAL | 0.53% | Nov 19, 2025 |
| CVE-2025-59342 | esm.sh writes arbitrary files via path traversal in `X-Zone-Id` header | MEDIUM | 3.01% | Sep 17, 2025 |
| CVE-2025-59341 | Local File Inclusion in esm.sh | HIGH | 1.64% | Sep 17, 2025 |
Showing 1 to 9 of 9 CVEs