esm-dev esm.sh

• CVE-2026-44594 High 7.5 esm.sh: Path Traversal via package.json browser field allows reading arbitrary server files 0.4%
• CVE-2026-44593 High 8.7 esm.sh: Legacy Route Path Traversal Can Lead to RCE 0.4%
• CVE-2026-27730 High 8.6 esm.sh has SSRF localhost/private-network bypass in `/http(s)` module route 0.4%
• CVE-2025-50180 High 8.7 esm.sh is vulnerable to full-response SSRF 0.4%
• CVE-2026-23644 High 7.7 esm.sh has path traversal in `extractPackageTarball` that enables file writes from malicious packages 0.6%
• CVE-2025-65026 Medium 6.1 esm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScript 0.5%
• CVE-2025-65025 High 8.2 esm.sh CDN service has arbitrary file write via tarslip 0.6%
• CVE-2025-59342 Medium 5.5 esm.sh writes arbitrary files via path traversal in `X-Zone-Id` header 3.2%
• CVE-2025-59341 High 7.7 Local File Inclusion in esm.sh 1.6%