Read the docs
TI-2026-19038 Aliases CVE-2026-23644GHSA-2657-3c98-63jq

esm.sh has path traversal in `extractPackageTarball` that enables file writes from malicious packages

Priority MEDIUM 40CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-22 and the CVSS impact.

Summary

esm.sh is a no-build content delivery network (CDN) for web development. Prior to Go pseeudoversion 0.0.0-20260116051925-c62ab83c589e, the software has a path traversal vulnerability due to an incomplete fix. `path.Clean` normalizes a path but does not prevent absolute paths in a malicious tar file. Commit https://github.com/esm-dev/esm.sh/commit/9d77b88c320733ff6689d938d85d246a3af9af16, corresponding to pseudoversion 0.0.0-20260116051925-c62ab83c589e, fixes this issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0056 46th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed esm.sh (esm-dev): 0.0.0-20260116051925-c62ab83c589egithub.com/esm-dev/esm.sh (Go): 0.0.0-20260116051925-c62ab83c589e

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
esm-devesm.shbefore 0.0.0-20260116051925-c62ab83c589e0.0.0-20260116051925-c62ab83c589ePatch availableCNA
—github.com/esm-dev/esm.sh (Go)0.0.1 – 136—No fix listedGHSA-2657-3c98-63jq
—github.com/esm-dev/esm.sh (Go)before 0.0.0-20260116051925-c62ab83c589e0.0.0-20260116051925-c62ab83c589ePatch availableGHSA-2657-3c98-63jq
  • esm.sh Vendoresm-dev Affected before 0.0.0-20260116051925-c62ab83c589e Fixed in 0.0.0-20260116051925-c62ab83c589e Patch available CNA
  • github.com/esm-dev/esm.sh (Go) Vendor— Affected 0.0.1 – 136 Fixed in — No fix listed GHSA-2657-3c98-63jq
  • github.com/esm-dev/esm.sh (Go) Vendor— Affected before 0.0.0-20260116051925-c62ab83c589e Fixed in 0.0.0-20260116051925-c62ab83c589e Patch available GHSA-2657-3c98-63jq

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:esm:esm.sh:*:*:*:*:*:*:*:*before 136Vulnerableesm-dev
  • cpe:2.3:a:esm:esm.sh:*:*:*:*:*:*:*:* Versions before 136 Vulnerable ·esm-dev

Remediation

  • Fix · CNA esm.sh (esm-dev) Fixed in 0.0.0-20260116051925-c62ab83c589e
  • Fix · GHSA-2657-3c98-63jq github.com/esm-dev/esm.sh (Go) Fixed in 0.0.0-20260116051925-c62ab83c589e Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-23644
  2. 2026-10-03 Alias added: GHSA-2657-3c98-63jq

References

Exploit 1

Patch 2

Advisory 2

Other 2

  • TI-2025-40211 esm.sh CDN service has arbitrary file write via tarslip CVSS 3.1CRITICAL 9.8
  • TI-2025-32063 esm.sh is vulnerable to full-response SSRF CVSS 4.0HIGH 8.7
  • TI-2025-40212 esm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScript CVSS 3.1CRITICAL 9.6
  • TI-2026-22092 esm.sh has SSRF localhost/private-network bypass in `/http(s)` module route CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences