Repository navigation
Security: esm-dev/esm.sh
Security
No security policy detected
This project has not set up a SECURITY.md file yet.
Report a vulnerability-
O(n²) + unbounded recursion in hasExternalExportStarGHSA-vmp2-ffm6-jv5f published
Oct 19, 2026 by ijeModerate -
Recurring path-traversal pattern across storage/module/web-path handling suggests no centralized, mandatory validation choke point (follow-up to CVE-2026-44593 / GHSA-3636-h3vx-6465)GHSA-85fc-q6w7-vwx4 published
Oct 19, 2026 by ijeModerate -
Unauthenticated package takeover, credential disclosure, and server-side code execution via unvalidated package names and trusted loader pathsGHSA-29qg-6q7w-cmm8 published
Oct 19, 2026 by ijeCritical -
The request origin (X-Real-Origin, or the Host header) is returned verbatim and interpolated into a double-quoted JS string in the served ?worker module, while the cache key omits it and the response is immutable with no Vary - arbitrary JS into an immutable-cached module; plus a JSON-to-JS injection the CVE-2025-65026 fix missedGHSA-575c-jj3w-hqjp published
Jul 26, 2026 by ijeCritical -
Private npm registry credentials are forwarded to cross-origin tarball URLsGHSA-9h7x-pggj-f6mq published
Jul 24, 2026 by ijeHigh -
web.NewHandler allows arbitrary file read via encoded dot-segment path traversalGHSA-g3c2-rjq2-c763 published
Jul 24, 2026 by ijeHigh -
Path traversal via package.json main field reads arbitrary host filesGHSA-qcj6-wfc2-w359 published
Jul 24, 2026 by ijeCritical -
Path Traversal via package.json browser field allows reading arbitrary server filesGHSA-rg65-45m7-hq57 published
May 8, 2026 by ijeHigh -
Dependency Name Path Traversal in installDependencies Leading to NPM Cache Poisoning and Loader HijackGHSA-xmrp-677j-v37h published
Oct 19, 2026 by ijeHigh -
Legacy Route Path Traversal Can Lead to RCEGHSA-3636-h3vx-6465 published
May 8, 2026 by ijeCritical
Learn more about advisories related to esm-dev/esm.sh in the GitHub Advisory Database