Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 5

Export CSV
CVE-2025-65026

esm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScript

esm.sh is a nobuild content delivery network(CDN) for modern web development. Prior to version 136, The esm.sh CDN service contains a Template Literal Injection vulnerability (CWE-94) in its CSS-to-JavaScript module conversion feature. When a CSS file is requested with the ?module query parameter, esm.sh converts it to a JavaScript module by embedding the CSS content directly into a template literal without proper sanitization. An attacker can inject malicious JavaScript code using ${...} expressions within CSS files, which will execute when the module is imported by victim applications. This enables Cross-Site Scripting (XSS) in browsers and Remote Code Execution (RCE) in Electron applications. This issue has been patched in version 136.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Esm Esm-dev
Products
Esm.sh Esmsh
CVE-2026-27730

esm.sh has SSRF localhost/private-network bypass in `/http(s)` module route

esm.sh is a no-build content delivery network (CDN) for web development. Versions up to and including 137 have an SSRF vulnerability (CWE-918) in esm.sh’s `/http(s)` fetch route. The service tries to block localhost/internal targets, but the validation is based on hostname string checks and can be bypassed using DNS alias domains. This allows an external requester to make the esm.sh server fetch internal localhost services. As of time of publication, no known patched versions exist.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Esm Esm-dev
Products
Esm.sh Esmsh
CVE-2026-23644

esm.sh has path traversal in `extractPackageTarball` that enables file writes from malicious packages

esm.sh is a no-build content delivery network (CDN) for web development. Prior to Go pseeudoversion 0.0.0-20260116051925-c62ab83c589e, the software has a path traversal vulnerability due to an incomplete fix. `path.Clean` normalizes a path but does not prevent absolute paths in a malicious tar file. Commit https://github.com/esm-dev/esm.sh/commit/9d77b88c320733ff6689d938d85d246a3af9af16, corresponding to pseudoversion 0.0.0-20260116051925-c62ab83c589e, fixes this issue.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Esm Esm-dev
Products
Esm.sh Esmsh
CVE-2025-50180

esm.sh is vulnerable to full-response SSRF

esm.sh is a no-build content delivery network (CDN) for web development. In version 136, esm.sh is vulnerable to a full-response SSRF, allowing an attacker to retrieve information from internal websites through the vulnerability. Version 137 fixes the vulnerability.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Esm Esm-dev
Products
Esm.sh Esmsh
CVE-2025-65025

esm.sh CDN service has arbitrary file write via tarslip

esm.sh is a nobuild content delivery network(CDN) for modern web development. Prior to version 136, the esm.sh CDN service is vulnerable to path traversal during NPM package tarball extraction. An attacker can craft a malicious NPM package containing specially crafted file paths (e.g., package/../../tmp/evil.js). When esm.sh downloads and extracts this package, files may be written to arbitrary locations on the server, escaping the intended extraction directory. This issue has been patched in version 136.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Esm Esm-dev
Products
Esm.sh Esmsh