Executive brief
esm.sh has arbitrary file write via path traversal in `X-Zone-Id` header in github.com/esm-dev/esm.sh
Affected products
- Go github.com/esm-dev/esm.sh
Junglewise Threat Intelligence
CVE-2025-59342: GO-2025-3967 - esm.sh has arbitrary file write via path traversal in `X-Zone-Id` header in github.com/esm-dev/esm.sh
CVE-2025-59342 · Severity: medium · CVSS 4 · Published 2025-09-24
Technologies: github.com/esm-dev/esm.sh (Go). Vendors: Go.
Related threats
- esm-dev esm.sh path traversal in package.json browser field
- esm.sh path traversal in legacy router leads to arbitrary file write
- GO-2026-4554 - esm.sh has SSRF localhost/private-network bypass in `/http(s)` module route in github.com/esm-dev/esm.sh
- GO-2026-4332 - esm.sh has a path traversal in extractPackageTarball enables file writes from malicious packages
- GO-2026-4545 - esm.sh is vulnerable to full-response SSRF in github.com/esm-dev/esm.sh