GoPackage

github.com/esm-dev/esm.sh

9 known vulnerabilities (7 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release: v0.2.0 (Oct 8, 2026): affected by 3 advisories
Newest unaffected release: Every release is affected by at least one advisory
Advisories: 9 · 7 high, 2 medium

Releases: 2 since v0.1.1 (Jun 11, 2026)
Registry: pkg.go.dev
Releases read: Nov 8, 2026

Version timeline

CVE-2026-44594
No published release is affected
No published release is affected
CVE-2026-44593
No published release is affected
No published release is affected
CVE-2026-27730
No published release is affected
No published release is affected
CVE-2025-50180
No published release is affected
No published release is affected
CVE-2026-23644
Affects v0.1.1 to v0.2.0 (through the newest release)
CVE-2025-65026
No published release is affected
No published release is affected
CVE-2025-65025
No published release is affected
No published release is affected
CVE-2025-59342
Affects v0.1.1 to v0.2.0 (through the newest release)
CVE-2025-59341
Affects v0.1.1 to v0.2.0 (through the newest release)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 9

CVE-2026-44594High 7.5
esm.sh: Path Traversal via package.json browser field allows reading arbitrary server files
Affected: fixed in 0.0.0-20250616164159-0593516c4cfa.
Fixed in v0.1.1 (released Jun 11, 2026, 14 days after disclosure, the advisory names 0.0.0-20250616164159-0593516c4cfa, which was never published).
The latest release, v0.2.0, is not affected.
CVE-2026-44593High 8.7
esm.sh: Legacy Route Path Traversal Can Lead to RCE
Affected: fixed in 0.0.0-20260508100112-1960055e1d53.
Fixed in v0.1.1 (released Jun 11, 2026, 14 days after disclosure, the advisory names 0.0.0-20260508100112-1960055e1d53, which was never published).
The latest release, v0.2.0, is not affected.
CVE-2026-27730High 8.6
esm.sh has SSRF localhost/private-network bypass in `/http(s)` module route
Affected: fixed in 0.0.0-20250616164159-0593516c4cfa.
Fixed in v0.1.1 (released Jun 11, 2026, 106 days after disclosure, the advisory names 0.0.0-20250616164159-0593516c4cfa, which was never published).
The latest release, v0.2.0, is not affected.
CVE-2025-50180High 8.7
esm.sh is vulnerable to full-response SSRF
Affected: fixed in 0.0.0-20250616164159-0593516c4cfa.
Fixed in v0.1.1 (released Jun 11, 2026, 106 days after disclosure, the advisory names 0.0.0-20250616164159-0593516c4cfa, which was never published).
The latest release, v0.2.0, is not affected.
CVE-2026-23644High 7.7
esm.sh has path traversal in `extractPackageTarball` that enables file writes from malicious packages
Affected: fixed in 0.0.0-20260116051925-c62ab83c589e; from 0.0.1, through 136.
No fix released. The advisory names 0.0.0-20260116051925-c62ab83c589e as the fix, which the registry doesn't have yet. The latest release, v0.2.0, is still affected.
CVE-2025-65026Medium 6.1
esm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScript
Affected: fixed in 0.0.0-20251118065157-87d2f6497574.
Fixed in v0.1.1 (released Jun 11, 2026, 204 days after disclosure, the advisory names 0.0.0-20251118065157-87d2f6497574, which was never published).
The latest release, v0.2.0, is not affected.
CVE-2025-65025High 8.2
esm.sh CDN service has arbitrary file write via tarslip
Affected: fixed in 0.0.0-20251117232647-9d77b88c3207.
Fixed in v0.1.1 (released Jun 11, 2026, 204 days after disclosure, the advisory names 0.0.0-20251117232647-9d77b88c3207, which was never published).
The latest release, v0.2.0, is not affected.
CVE-2025-59342Medium 5.5
esm.sh writes arbitrary files via path traversal in `X-Zone-Id` header
Affected: fixed in 136.1; all versions.
No fix released. The latest release, v0.2.0, is still affected.
CVE-2025-59341High 7.7
Local File Inclusion in esm.sh
Affected: all versions; through 136.
No fix released. The latest release, v0.2.0, is still affected.