ES
Vendor
esm-dev
9
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-44594 | ES esm.sh esm-dev | 7.5 | May 28 | esm.sh: Path Traversal via package.json browser field allows reading arbitrary server files |
| CVE-2026-44593 | ES esm.sh esm-dev | 8.7 | May 28 | esm.sh: Legacy Route Path Traversal Can Lead to RCE |
| CVE-2026-27730 | ES esm.sh esm-dev | 7.5 | Feb 25 | esm.sh has SSRF localhost/private-network bypass in `/http(s)` module route |
| CVE-2025-50180 | ES esm.sh esm-dev | 7.5 | Feb 25 | esm.sh is vulnerable to full-response SSRF |
| CVE-2026-23644 | ES esm.sh esm-dev | 7.5 | Jan 18 | esm.sh has path traversal in `extractPackageTarball` that enables file writes from malicious packages |
| CVE-2025-65026 | ES esm.sh esm-dev | 9.6 | Nov 19 | esm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScript |
| CVE-2025-65025 | ES esm.sh esm-dev | 9.8 | Nov 19 | esm.sh CDN service has arbitrary file write via tarslip |
| CVE-2025-59342 | ES esm.sh esm-dev | 5.5 | Sep 17 | esm.sh writes arbitrary files via path traversal in `X-Zone-Id` header |
| CVE-2025-59341 | ES esm.sh esm-dev | 7.7 | Sep 17 | Local File Inclusion in esm.sh |