{"action":"Upgrade github.com/esm-dev/esm.sh to 0.0.0-20260116051925-c62ab83c589e or later.","affected":[{"introduced":"0"}],"component":"github.com/esm-dev/esm.sh","cve_ids":["CVE-2026-23644"],"ecosystem":"Go","epss":0.0056,"exploited":false,"fixed_versions":["0.0.0-20260116051925-c62ab83c589e"],"ghsa_id":"GHSA-2657-3c98-63jq","id":"tcs_01M5KGD5E0QYZ9YCNDMCCF4W1R","modified_at":"2026-02-26T18:56:10.373396Z","published_at":"2026-02-26T16:27:46Z","references":["https://osv.dev/vulnerability/GO-2026-4332","https://github.com/esm-dev/esm.sh/security/advisories/GHSA-2657-3c98-63jq","https://nvd.nist.gov/vuln/detail/CVE-2026-23644","https://github.com/esm-dev/esm.sh/commit/9d77b88c320733ff6689d938d85d246a3af9af16","https://github.com/esm-dev/esm.sh/commit/c62ab83c589e7b421a0e1376d2a00a4e48161093"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GO-2026-4332","url":"https://osv.dev/vulnerability/GO-2026-4332"},{"source":"nvd","source_id":"CVE-2026-23644","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23644"}],"summary":"esm.sh has a path traversal in extractPackageTarball enables file writes from malicious packages"}