Esm
Monthly
esm.sh versions up to 137 contain an SSRF vulnerability in the `/http(s)` fetch route that allows remote attackers to bypass hostname validation through DNS alias domains and access internal localhost services. Public exploit code exists for this vulnerability, and no patches are currently available. This affects users of esm.sh CDN services and any applications relying on the affected versions.
Path traversal in esm.sh CDN prior to version 0.0.0-20260116051925-c62ab83c589e allows unauthenticated remote attackers to write arbitrary files to the server through malicious tar archives, bypassing incomplete path sanitization. Public exploit code exists for this vulnerability. The issue stems from improper validation of absolute paths in tar file entries, enabling potential code execution or service disruption on affected systems.
esm.sh is a no-build content delivery network (CDN) for web development. In version 136, esm.sh is vulnerable to a full-response SSRF, allowing an attacker to retrieve information from internal websites through the vulnerability. [CVSS 7.5 HIGH]
Template literal injection in esm.sh before version 136 allows unauthenticated remote attackers to execute arbitrary JavaScript when a victim application imports a CSS file converted through the ?module feature. Since backtick-free CSS is embedded directly into a JavaScript template literal without escaping ${...} expressions, crafted CSS can achieve XSS in browsers and RCE in Electron applications; publicly available exploit code exists, but EPSS is low at 0.03% and active exploitation is not confirmed in CISA KEV. The issue requires user interaction because the payload executes only when the generated module is imported by a victim application.
Path traversal during NPM tarball extraction in esm.sh CDN versions prior to 136 allows unauthenticated remote attackers to write files outside the intended package directory. Exploitation requires the attacker to point esm.sh at an attacker-controlled registry via the X-Npmrc header, because official registries reject tarball entries containing '../'; the built-in extension allow-list limits writes to file types such as .js, .css, and .json, but still permits dropping executable JavaScript into sensitive locations. Publicly available exploit code exists, no CISA KEV confirmation of active exploitation was provided, and EPSS is low at roughly 0.05% (14th percentile); the vendor-released fix is version 136.
esm.sh versions up to 137 contain an SSRF vulnerability in the `/http(s)` fetch route that allows remote attackers to bypass hostname validation through DNS alias domains and access internal localhost services. Public exploit code exists for this vulnerability, and no patches are currently available. This affects users of esm.sh CDN services and any applications relying on the affected versions.
Path traversal in esm.sh CDN prior to version 0.0.0-20260116051925-c62ab83c589e allows unauthenticated remote attackers to write arbitrary files to the server through malicious tar archives, bypassing incomplete path sanitization. Public exploit code exists for this vulnerability. The issue stems from improper validation of absolute paths in tar file entries, enabling potential code execution or service disruption on affected systems.
esm.sh is a no-build content delivery network (CDN) for web development. In version 136, esm.sh is vulnerable to a full-response SSRF, allowing an attacker to retrieve information from internal websites through the vulnerability. [CVSS 7.5 HIGH]
Template literal injection in esm.sh before version 136 allows unauthenticated remote attackers to execute arbitrary JavaScript when a victim application imports a CSS file converted through the ?module feature. Since backtick-free CSS is embedded directly into a JavaScript template literal without escaping ${...} expressions, crafted CSS can achieve XSS in browsers and RCE in Electron applications; publicly available exploit code exists, but EPSS is low at 0.03% and active exploitation is not confirmed in CISA KEV. The issue requires user interaction because the payload executes only when the generated module is imported by a victim application.
Path traversal during NPM tarball extraction in esm.sh CDN versions prior to 136 allows unauthenticated remote attackers to write files outside the intended package directory. Exploitation requires the attacker to point esm.sh at an attacker-controlled registry via the X-Npmrc header, because official registries reject tarball entries containing '../'; the built-in extension allow-list limits writes to file types such as .js, .css, and .json, but still permits dropping executable JavaScript into sensitive locations. Publicly available exploit code exists, no CISA KEV confirmation of active exploitation was provided, and EPSS is low at roughly 0.05% (14th percentile); the vendor-released fix is version 136.