Executive brief
esm.sh has SSRF localhost/private-network bypass in `/http(s)` module route in github.com/esm-dev/esm.sh
Affected products
- Go github.com/esm-dev/esm.sh
Junglewise Threat Intelligence
CVE-2026-27730: GO-2026-4554 - esm.sh has SSRF localhost/private-network bypass in `/http(s)` module route in github.com/esm-dev/esm.sh
CVE-2026-27730 · Severity: low · CVSS 3 · Published 2026-02-27
Technologies: github.com/esm-dev/esm.sh (Go). Vendors: Go.
Related threats
- esm-dev esm.sh path traversal in package.json browser field
- esm.sh path traversal in legacy router leads to arbitrary file write
- GO-2026-4332 - esm.sh has a path traversal in extractPackageTarball enables file writes from malicious packages
- GO-2026-4545 - esm.sh is vulnerable to full-response SSRF in github.com/esm-dev/esm.sh
- GO-2025-4139 - esm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScript in github.com/esm-dev/esm.sh