What’s Vulnerable › Products

esm-dev esm.sh vulnerabilities

9 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 9 published in the last 12 months.

Check whether your esm-dev esm.sh version is affected

Latest esm-dev esm.sh vulnerabilities

• CVE-2026-44594 — esm.sh: Path Traversal via package.json browser field allows reading arbitrary server files (CVSS 7.5)
• CVE-2026-44593 — esm.sh: Legacy Route Path Traversal Can Lead to RCE (CVSS 8.7)
• CVE-2026-27730 — esm.sh has SSRF localhost/private-network bypass in `/http(s)` module route (CVSS 7.5)
• CVE-2025-50180 — esm.sh is vulnerable to full-response SSRF (CVSS 7.5)
• CVE-2026-23644 — esm.sh has path traversal in `extractPackageTarball` that enables file writes from malicious packages (CVSS 7.5)
• CVE-2025-65026 — esm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScript (CVSS 9.6)
• CVE-2025-65025 — esm.sh CDN service has arbitrary file write via tarslip (CVSS 9.8)
• CVE-2025-59342 — esm.sh writes arbitrary files via path traversal in `X-Zone-Id` header (CVSS 5.5)
• CVE-2025-59341 — Local File Inclusion in esm.sh (CVSS 7.7)