File and Path Handling

Every one of the 7 is a mark on the map. Named now: 1 to 7, most at risk first.

1. esm.sh <= v136 - Arbitrary File Write via Path TraversalCVE-2025-59342esm-dev · CVSS 5.5 · 3.2% likely

   CWE-24

2. esm.sh <= v136 - Local File InclusionCVE-2025-59341esm-dev · CVSS 7.7 · 1.6% likely

   CWE-23

3. esm.sh: web.NewHandler allows arbitrary file read via encoded dot-segment path traversalCVE-2026-102657esm-dev · CVSS 7.5 · 0.7% likely

   CWE-22

4. esm.sh CDN service has arbitrary file write via tarslipCVE-2025-65025esm-dev · CVSS 8.2 · 0.6% likely

   CWE-22

5. esm.sh has path traversal in `extractPackageTarball` that enables file writes from malicious packagesCVE-2026-23644esm-dev · CVSS 7.7 · 0.6% likely

   CWE-22

6. esm.sh: Legacy Route Path Traversal Can Lead to RCECVE-2026-44593esm-dev · CVSS 8.7 · 0.4% likely

   CWE-22

7. esm.sh: Path Traversal via package.json browser field allows reading arbitrary server filesCVE-2026-44594esm-dev · CVSS 7.5 · 0.4% likely

   CWE-22

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.