High · published November 19, 2025
⚡ A crafty path traversal vulnerability lets mischief-makers sneak files where they shouldn't! Before version 136, esm.sh's CDN could be tricked into writing files to arbitrary locations during tarball extraction. 🔥 This is like a delivery driver who blindly follows a package label that says "Drop off at the back door of the building," without checking if it actually belongs there, allowing threats to sneak in unsuspected! An attacker could exploit this flaw to write malicious files anywhere on the server, potentially allowing them to execute harmful scripts or gain unauthorized access. With the wrong package, they could infiltrate your entire system! It's a serious breach waiting to happen, and we definitely don't want that!
This is like a delivery driver who blindly follows a package label that says "Drop off at the back door of the building," without checking if it actually belongs there, allowing threats to sneak in unsuspected! This vulnerability occurs during the extraction of NPM packages, where attackers can craft file paths that escape the designated extraction directory, leading to unauthorized file writing on the server.
An attacker could exploit this flaw to write malicious files anywhere on the server, potentially allowing them to execute harmful scripts or gain unauthorized access. With the wrong package, they could infiltrate your entire system! It's a serious breach waiting to happen, and we definitely don't want that! Update esm.sh to version 136 or later immediately to close this path traversal vulnerability. Additionally, ensure your system verifies the integrity of packages before extraction to prevent malicious files from wreaking havoc. You've got this! Follow these steps to secure your setup and keep your environment safe. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| esm/esm.sh | < 136 | 136 |