Esm

Esm.Sh

5 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
7.5

CVE-2026-27730

Exploit
  • EPSS 0.04%
  • Veröffentlicht 25.02.2026 15:37:01
  • Zuletzt bearbeitet 27.02.2026 17:43:47

esm.sh is a no-build content delivery network (CDN) for web development. Versions up to and including 137 have an SSRF vulnerability (CWE-918) in esm.sh’s `/http(s)` fetch route. The service tries to block localhost/internal targets, but the validati...

7.5

CVE-2025-50180

Exploit
  • EPSS 0.04%
  • Veröffentlicht 25.02.2026 15:32:56
  • Zuletzt bearbeitet 27.02.2026 17:44:36

esm.sh is a no-build content delivery network (CDN) for web development. In version 136, esm.sh is vulnerable to a full-response SSRF, allowing an attacker to retrieve information from internal websites through the vulnerability. Version 137 fixes th...

7.5

CVE-2026-23644

Exploit
  • EPSS 0.1%
  • Veröffentlicht 18.01.2026 22:49:29
  • Zuletzt bearbeitet 18.02.2026 16:10:48

esm.sh is a no-build content delivery network (CDN) for web development. Prior to Go pseeudoversion 0.0.0-20260116051925-c62ab83c589e, the software has a path traversal vulnerability due to an incomplete fix. `path.Clean` normalizes a path but does n...

9.6

CVE-2025-65026

Exploit
  • EPSS 0.02%
  • Veröffentlicht 19.11.2025 17:33:11
  • Zuletzt bearbeitet 15.01.2026 17:53:57

esm.sh is a nobuild content delivery network(CDN) for modern web development. Prior to version 136, The esm.sh CDN service contains a Template Literal Injection vulnerability (CWE-94) in its CSS-to-JavaScript module conversion feature. When a CSS fil...

9.8

CVE-2025-65025

Exploit
  • EPSS 0.04%
  • Veröffentlicht 19.11.2025 17:32:46
  • Zuletzt bearbeitet 15.01.2026 17:52:38

esm.sh is a nobuild content delivery network(CDN) for modern web development. Prior to version 136, the esm.sh CDN service is vulnerable to path traversal during NPM package tarball extraction. An attacker can craft a malicious NPM package containing...