Read the docs

esm-dev

Records10All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high7CVSS 7.0–8.9

Exploited now

esm-dev records in CISA KEV

No esm-dev vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Esm.sh 5 records HIGH

Records

10 records

TI-2025-40211 CVE-2025-65025 · GHSA-h3mw-4f23-gwpw

esm.sh CDN service has arbitrary file write via tarslip

Priority HIGH 81

esm.sh is a nobuild content delivery network(CDN) for modern web development.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00571 Published 2025-11-19 Fixed in 136, 0.0.0-20251117232647-9d77b88c3207 CWE-22
TI-2026-32504 CVE-2026-44593 · GHSA-3636-h3vx-6465

esm.sh: Legacy Route Path Traversal Can Lead to RCE

Priority HIGH 77

esm.sh is a no-build content delivery network (CDN) for web development.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00437 Published 2026-05-28 Fixed in 0.0.0-20260508100112-1960055e1d53 CWE-22
TI-2025-32063 CVE-2025-50180 · GHSA-3c9r-837r-qqm4

esm.sh is vulnerable to full-response SSRF

Priority HIGH 77

esm.sh is a no-build content delivery network (CDN) for web development.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00437 Published 2026-02-25 Fixed in 0.0.0-20250616164159-0593516c4cfa CWE-918
TI-2025-36902 CVE-2025-59341 · GHSA-49pv-gwxp-532r

Local File Inclusion in esm.sh

Priority HIGH 73

esm.sh is a nobuild content delivery network(CDN) for modern web development.

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.01636 Published 2025-09-17 No fix listed CWE-23
Open these records in search →