Vulnerabilities

TI-2026-86122 CVE-2026-102657

Path traversal in esm.sh web.NewHandler allows arbitrary file read

LOW 34

esm.sh is a no-build content delivery network (CDN) for web development.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00716 Published 2026-11-06 Fixed in 137_7 CWE-22

TI-2026-32505 CVE-2026-44594 · GHSA-rg65-45m7-hq57

esm.sh: Path Traversal via package.json browser field allows reading arbitrary server files

HIGH 72

esm.sh is a no-build content delivery network (CDN) for web development.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00387 Published 2026-05-28 Fixed in 0.0.0-20250616164159-0593516c4cfa CWE-22

TI-2026-32504 CVE-2026-44593 · GHSA-3636-h3vx-6465

esm.sh: Legacy Route Path Traversal Can Lead to RCE

HIGH 77

esm.sh is a no-build content delivery network (CDN) for web development.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00437 Published 2026-05-28 Fixed in 0.0.0-20260508100112-1960055e1d53 CWE-22

TI-2026-22092 CVE-2026-27730 · GHSA-p2v6-84h2-5x4r

esm.sh has SSRF localhost/private-network bypass in `/http(s)` module route

HIGH 66

esm.sh is a no-build content delivery network (CDN) for web development.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00386 Published 2026-02-25 Fixed in 0.0.0-20250616164159-0593516c4cfa CWE-918

TI-2025-32063 CVE-2025-50180 · GHSA-3c9r-837r-qqm4

esm.sh is vulnerable to full-response SSRF

HIGH 77

esm.sh is a no-build content delivery network (CDN) for web development.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00437 Published 2026-02-25 Fixed in 0.0.0-20250616164159-0593516c4cfa CWE-918

TI-2026-19038 CVE-2026-23644 · GHSA-2657-3c98-63jq

esm.sh has path traversal in `extractPackageTarball` that enables file writes from malicious packages

MEDIUM 40

esm.sh is a no-build content delivery network (CDN) for web development.

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.0056 Published 2026-01-18 Fixed in 0.0.0-20260116051925-c62ab83c589e CWE-22

TI-2025-40212 CVE-2025-65026 · GHSA-hcpf-qv9m-vfgp

esm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScript

HIGH 74

esm.sh is a nobuild content delivery network(CDN) for modern web development.

CVSS 3.1CRITICAL 9.6 Network No auth User interaction EPSS 0.00514 Published 2025-11-19 Fixed in 136, 0.0.0-20251118065157-87d2f6497574 CWE-94

TI-2025-40211 CVE-2025-65025 · GHSA-h3mw-4f23-gwpw

esm.sh CDN service has arbitrary file write via tarslip

HIGH 81

esm.sh is a nobuild content delivery network(CDN) for modern web development.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00571 Published 2025-11-19 Fixed in 136, 0.0.0-20251117232647-9d77b88c3207 CWE-22

TI-2025-36903 CVE-2025-59342 · GHSA-g2h5-cvvr-7gmw

esm.sh writes arbitrary files via path traversal in `X-Zone-Id` header

MEDIUM 64

esm.sh is a nobuild content delivery network(CDN) for modern web development.

CVSS 4.0MEDIUM 5.5 Network No auth No interaction EPSS 0.03153 Published 2025-09-17 Fixed in 136.1 CWE-24

TI-2025-36902 CVE-2025-59341 · GHSA-49pv-gwxp-532r

Local File Inclusion in esm.sh

HIGH 73

esm.sh is a nobuild content delivery network(CDN) for modern web development.

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.01636 Published 2025-09-17 No fix listed CWE-23

Vulnerabilities

Filters