https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 07:14:55 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-261426 EUVD-2026-261426 https://cve.radiocsirt.org/vuln/euvd-2026-261426 https://cve.radiocsirt.org/vuln/fkie_cve-2025-65025 <p>esm.sh is a nobuild content delivery network(CDN) for modern web development. Prior to version 136, the esm.sh CDN service is vulnerable to path traversal during NPM package tarball extraction. An attacker can craft a malicious NPM package containing specially crafted file paths (e.g., package/../../tmp/evil.js). When esm.sh downloads and extracts this package, files may be written to arbitrary locations on the server, escaping the intended extraction directory. This issue has been patched in version 136.</p> <p>esm.sh is a nobuild content delivery network(CDN) for modern web development. Prior to version 136, the esm.sh CDN service is vulnerable to path traversal during NPM package tarball extraction. An attacker can craft a malicious NPM package containing specially crafted file paths (e.g., package/../../tmp/evil.js). When esm.sh downloads and extracts this package, files may be written to arbitrary locations on the server, escaping the intended extraction directory. This issue has been patched in version 136.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-65025 https://cve.radiocsirt.org/vuln/ghsa-h3mw-4f23-gwpw <p><strong>Affected:</strong> Go: github.com/esm-dev/esm.sh</p> <p>### Summary The esm.sh CDN service is vulnerable to a Path Traversal (CWE-22) vulnerability during NPM package tarball extraction. An attacker can craft a malicious NPM package containing specially crafted file paths (e.g., `package/../../tmp/evil.js`). When esm.sh downloads and extracts this package, files may be written to arbitrary locations on the server, escaping the intended extraction directory.</p> <p>Uploading files containing `../` in the path is not allowed on official registries (npm, GitHub), but the `X-Npmrc` header allows specifying any arbitrary registry. By setting the registry to an attacker-controlled server via the `X-Npmrc` header, this vulnerability can be triggered.</p> <p>### Details **file:** `server/npmrc.go` **line:** 552-567</p> <p>```go func extractPackageTarball(installDir string, pkgName string, tarball io.Reader) (err error) { pkgDir := path.Join(installDir, &#34;node_modules&#34;, pkgName) tr := tar.NewReader(unziped) for { h, err := tr.Next() // ... // Strip tarball root directory _, name := utils.SplitByFirstByte(h.Name, &#39;/&#39;) // &#34;package/../../tmp/evil&#34; → &#34;../../tmp/evil&#34; filename := path.Join(pkgDir, name) // ← No validation if h.Typeflag != tar.TypeReg { continue } // Extension filtering extname := path.Ext(filename) if !(extname != &#34;&#34; &amp;&amp; (allowed_extensions)) { continue // Only extract .js,…</p> <p><strong>Affected:</strong> Go: github.com/esm-dev/esm.sh</p> <p>### Summary The esm.sh CDN service is vulnerable to a Path Traversal (CWE-22) vulnerability during NPM package tarball extraction. An attacker can craft a malicious NPM package containing specially crafted file paths (e.g., `package/../../tmp/evil.js`). When esm.sh downloads and extracts this package, files may be written to arbitrary locations on the server, escaping the intended extraction directory.</p> <p>Uploading files containing `../` in the path is not allowed on official registries (npm, GitHub), but the `X-Npmrc` header allows specifying any arbitrary registry. By setting the registry to an attacker-controlled server via the `X-Npmrc` header, this vulnerability can be triggered.</p> <p>### Details **file:** `server/npmrc.go` **line:** 552-567</p> <p>```go func extractPackageTarball(installDir string, pkgName string, tarball io.Reader) (err error) { pkgDir := path.Join(installDir, &#34;node_modules&#34;, pkgName) tr := tar.NewReader(unziped) for { h, err := tr.Next() // ... // Strip tarball root directory _, name := utils.SplitByFirstByte(h.Name, &#39;/&#39;) // &#34;package/../../tmp/evil&#34; → &#34;../../tmp/evil&#34; filename := path.Join(pkgDir, name) // ← No validation if h.Typeflag != tar.TypeReg { continue } // Extension filtering extname := path.Ext(filename) if !(extname != &#34;&#34; &amp;&amp; (allowed_extensions)) { continue // Only extract .js,…</p> https://cve.radiocsirt.org/vuln/ghsa-h3mw-4f23-gwpw