CVE-2026-23644
High · 7.5CVSS
7.5
EPSS
0.6%
Published
Jan 18, 2026
CISA due date
—
The record
esm.sh is a no-build content delivery network (CDN) for web development. Prior to Go pseeudoversion 0.0.0-20260116051925-c62ab83c589e, the software has a path traversal vulnerability due to an incomplete fix. `path.Clean` normalizes a path but does not prevent absolute paths in a malicious tar file. Commit https://github.com/esm-dev/esm.sh/commit/9d77b88c320733ff6689d938d85d246a3af9af16, corresponding to pseudoversion 0.0.0-20260116051925-c62ab83c589e, fixes this issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/esm-dev/esm.sh | 0 | 0.0.0-20260116051925-c62ab83c589e |
| Go | github.com/esm-dev/esm.sh | 0.0.1 | No fix |
| go | github.com/esm-dev/esm.sh | 0.0.1 | No fix |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260226T182644-150000.1.149.1 |
Related vulnerabilities
- GO-2026-4332 esm.sh has a path traversal in extractPackageTarball enables file writes from malicious… Same vulnerability
- GO-2026-4545 esm.sh is vulnerable to full-response SSRF in github.com/esm-dev/esm.sh Also affects github.com/esm-dev/esm.sh
- CVE-2026-27730 esm.sh is a no-build content delivery network (CDN) for web development. Also affects github.com/esm-dev/esm.sh
- CVE-2025-50180 esm.sh is a no-build content delivery network (CDN) for web development. Also affects github.com/esm-dev/esm.sh
- GO-2025-4138 esm.sh CDN service has arbitrary file write via tarslip in github.com/esm-dev/esm.sh Also affects github.com/esm-dev/esm.sh
- GO-2025-4139 esm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScript in… Also affects github.com/esm-dev/esm.sh
- CVE-2025-65026 esm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScript Also affects github.com/esm-dev/esm.sh
- CVE-2025-65025 esm.sh CDN service has arbitrary file write via tarslip Also affects github.com/esm-dev/esm.sh