Executive brief
esm.sh has a path traversal in extractPackageTarball enables file writes from malicious packages
Affected products
- Go github.com/esm-dev/esm.sh
Junglewise Threat Intelligence
CVE-2026-23644: GO-2026-4332 - esm.sh has a path traversal in extractPackageTarball enables file writes from malicious packages
CVE-2026-23644 · Severity: medium · CVSS 4 · Published 2026-02-26
Technologies: github.com/esm-dev/esm.sh (Go). Vendors: Go.
Related threats
- esm-dev esm.sh path traversal in package.json browser field
- esm.sh path traversal in legacy router leads to arbitrary file write
- GO-2026-4554 - esm.sh has SSRF localhost/private-network bypass in `/http(s)` module route in github.com/esm-dev/esm.sh
- GO-2026-4545 - esm.sh is vulnerable to full-response SSRF in github.com/esm-dev/esm.sh
- GO-2025-4139 - esm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScript in github.com/esm-dev/esm.sh