Login Request a demo
ES
Product
esm.sh
by esm-dev · last CVE May 28, 2026
9
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities9In the news0Timeline
Severity mix
Critical 2High 6Medium 1Low 0
Severity
All severities9Critical2High6Medium1Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add esm.sh to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-65025
9.8
1%
Nov 19
esm.sh CDN service has arbitrary file write via tarslip
Affected: < 136
CVE-2025-65026
9.6
1%
Nov 19
esm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScript
Affected: < 136
CVE-2026-44593
8.7
0%
May 28
esm.sh: Legacy Route Path Traversal Can Lead to RCE
Affected: <= 137
CVE-2025-59341
7.7
2%
Sep 17
Local File Inclusion in esm.sh
Affected: <= 136
CVE-2026-44594
7.5
0%
May 28
esm.sh: Path Traversal via package.json browser field allows reading arbitrary server files
Affected: <= 137
CVE-2026-27730
7.5
0%
Feb 25
esm.sh has SSRF localhost/private-network bypass in `/http(s)` module route
Affected: <= 137
CVE-2025-50180
7.5
0%
Feb 25
esm.sh is vulnerable to full-response SSRF
Affected: = 136
CVE-2026-23644
7.5
1%
Jan 18
esm.sh has path traversal in `extractPackageTarball` that enables file writes from malicious packages
Affected: < 0.0.0-20260116051925-c62ab83c589e
CVE-2025-59342
5.5
3%
Sep 17
esm.sh writes arbitrary files via path traversal in `X-Zone-Id` header
Affected: <= 136
Showing 9