CVE-2026-23644

esm.sh (a no-build CDN) has a path traversal vulnerability in the extractPackageTarball code path. The issue stems from using path.Clean, which normalizes paths but does not prevent absolute paths inside malicious tar files, allowing potential file writes. The vulnerability existed prior to the G...