CVE-2025-59342

CVE-2025-59342 - パストラバーサル esm-dev 作者: Byte Reaper 説明 CVE-2025-59342 は、esm.sh におけるパストラバーサルの脆弱性です。esm.sh は、現代のWeb開発向けのノービルド・コンテンツデリバリネットワーク CDN であり、バージョン136以前が影響を受けます。 問題は、X-Zone-Id HTTPヘッダーの処理に存在します。このヘッダーはファイルシステムパスを構築するために使用されますが、ヘッダーの値が適切に正規化されておらず、アプリケーションのストレージベースディレクトリに制限されていません。...

GO-2025-3967 esm.sh has arbitrary file write via path traversal in `X-Zone-Id` header in github.com/esm-dev/esm.sh

esm.sh has arbitrary file write via path traversal in X-Zone-Id header in github.com/esm-dev/esm.sh...

CVE-2025-59342

esm.sh is a nobuild content delivery networkCDN for modern web development. In 136 and earlier, a path-traversal flaw in the handling of the X-Zone-Id HTTP header allows an attacker to cause the application to write files outside the intended storage location. The header value is used to build a...

CVE-2025-59342 esm.sh writes arbitrary files via path traversal in `X-Zone-Id` header

esm.sh is a nobuild content delivery networkCDN for modern web development. In 136 and earlier, a path-traversal flaw in the handling of the X-Zone-Id HTTP header allows an attacker to cause the application to write files outside the intended storage location. The header value is used to build a...

esm.sh 安全漏洞

esm.sh is a content delivery network open-sourced by esm.sh. A security vulnerability exists in esm.sh version 136 and earlier, which stems from improper handling of the X-Zone-Id HTTP header and could lead to a path traversal attack...

PT-2025-38248

Name of the Vulnerable Software and Affected Versions esm.sh versions 136 and earlier Description A path-traversal flaw exists in the handling of the X-Zone-Id HTTP header. The header value is used to construct a filesystem path without proper sanitization or restriction to the application’s...