# github.com/esm-dev/esm.sh (Go) vulnerabilities 9 known vulnerabilities (7 high, 2 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: v0.2.0 (Oct 8, 2026): affected by 3 advisories - Newest unaffected release: Every release is affected by at least one advisory - Releases: 2 since v0.1.1 (Jun 11, 2026) - Registry: https://pkg.go.dev/github.com/esm-dev/esm.sh - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-44594: no published release is affected - CVE-2026-44593: no published release is affected - CVE-2026-27730: no published release is affected - CVE-2025-50180: no published release is affected - CVE-2026-23644: v0.1.1 to v0.2.0 (through the newest release) - CVE-2025-65026: no published release is affected - CVE-2025-65025: no published release is affected - CVE-2025-59342: v0.1.1 to v0.2.0 (through the newest release) - CVE-2025-59341: v0.1.1 to v0.2.0 (through the newest release) ## Advisories (9) ### [CVE-2026-44594](https://cve.now/CVE-2026-44594): esm.sh: Path Traversal via package.json browser field allows reading arbitrary server files - Severity: High 7.5 - Published: May 28, 2026 - Affected: fixed in 0.0.0-20250616164159-0593516c4cfa. - Fixed in v0.1.1 (released Jun 11, 2026, 14 days after disclosure, the advisory names 0.0.0-20250616164159-0593516c4cfa, which was never published). - The latest release, v0.2.0, is not affected. ### [CVE-2026-44593](https://cve.now/CVE-2026-44593): esm.sh: Legacy Route Path Traversal Can Lead to RCE - Severity: High 8.7 - Published: May 28, 2026 - Affected: fixed in 0.0.0-20260508100112-1960055e1d53. - Fixed in v0.1.1 (released Jun 11, 2026, 14 days after disclosure, the advisory names 0.0.0-20260508100112-1960055e1d53, which was never published). - The latest release, v0.2.0, is not affected. ### [CVE-2026-27730](https://cve.now/CVE-2026-27730): esm.sh has SSRF localhost/private-network bypass in \`/http(s)\` module route - Severity: High 8.6 - Published: Feb 25, 2026 - Affected: fixed in 0.0.0-20250616164159-0593516c4cfa. - Fixed in v0.1.1 (released Jun 11, 2026, 106 days after disclosure, the advisory names 0.0.0-20250616164159-0593516c4cfa, which was never published). - The latest release, v0.2.0, is not affected. ### [CVE-2025-50180](https://cve.now/CVE-2025-50180): esm.sh is vulnerable to full-response SSRF - Severity: High 8.7 - Published: Feb 25, 2026 - Affected: fixed in 0.0.0-20250616164159-0593516c4cfa. - Fixed in v0.1.1 (released Jun 11, 2026, 106 days after disclosure, the advisory names 0.0.0-20250616164159-0593516c4cfa, which was never published). - The latest release, v0.2.0, is not affected. ### [CVE-2026-23644](https://cve.now/CVE-2026-23644): esm.sh has path traversal in \`extractPackageTarball\` that enables file writes from malicious packages - Severity: High 7.7 - Published: Jan 18, 2026 - Affected: fixed in 0.0.0-20260116051925-c62ab83c589e; from 0.0.1, through 136. - No fix released. The advisory names 0.0.0-20260116051925-c62ab83c589e as the fix, which the registry doesn't have yet. The latest release, v0.2.0, is still affected. ### [CVE-2025-65026](https://cve.now/CVE-2025-65026): esm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScript - Severity: Medium 6.1 - Published: Nov 19, 2025 - Affected: fixed in 0.0.0-20251118065157-87d2f6497574. - Fixed in v0.1.1 (released Jun 11, 2026, 204 days after disclosure, the advisory names 0.0.0-20251118065157-87d2f6497574, which was never published). - The latest release, v0.2.0, is not affected. ### [CVE-2025-65025](https://cve.now/CVE-2025-65025): esm.sh CDN service has arbitrary file write via tarslip - Severity: High 8.2 - Published: Nov 19, 2025 - Affected: fixed in 0.0.0-20251117232647-9d77b88c3207. - Fixed in v0.1.1 (released Jun 11, 2026, 204 days after disclosure, the advisory names 0.0.0-20251117232647-9d77b88c3207, which was never published). - The latest release, v0.2.0, is not affected. ### [CVE-2025-59342](https://cve.now/CVE-2025-59342): esm.sh writes arbitrary files via path traversal in \`X-Zone-Id\` header - Severity: Medium 5.5 - Published: Sep 17, 2025 - Affected: fixed in 136.1; all versions. - No fix released. The latest release, v0.2.0, is still affected. ### [CVE-2025-59341](https://cve.now/CVE-2025-59341): Local File Inclusion in esm.sh - Severity: High 7.7 - Published: Sep 17, 2025 - Affected: all versions; through 136. - No fix released. The latest release, v0.2.0, is still affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/github.com/esm-dev/esm.sh Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.