TI-2026-22092 Aliases CVE-2026-27730 GHSA-p2v6-84h2-5x4r

esm.sh has SSRF localhost/private-network bypass in `/http(s)` module route

HIGH 66CWE-918Published 2026-02-25 · Updated 2026-02-25

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-918 and the CVSS impact.

Summary

esm.sh is a no-build content delivery network (CDN) for web development. Versions up to and including 137 have an SSRF vulnerability (CWE-918) in esm.sh’s `/http(s)` fetch route. The service tries to block localhost/internal targets, but the validation is based on hostname string checks and can be bypassed using DNS alias domains. This allows an external requester to make the esm.sh server fetch internal localhost services. As of time of publication, no known patched versions exist.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00386 32nd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed github.com/esm-dev/esm.sh (Go): 0.0.0-20250616164159-0593516c4cfa

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
esm-dev	esm.sh	up to 137	—	No fix listed	CNA
—	github.com/esm-dev/esm.sh (Go)	before 0.0.0-20250616164159-0593516c4cfa	0.0.0-20250616164159-0593516c4cfa	Patch available	GHSA-p2v6-84h2-5x4r

esm.sh Vendoresm-dev Affected up to 137 Fixed in — No fix listed CNA
github.com/esm-dev/esm.sh (Go) Vendor— Affected before 0.0.0-20250616164159-0593516c4cfa Fixed in 0.0.0-20250616164159-0593516c4cfa Patch available GHSA-p2v6-84h2-5x4r

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:esm:esm.sh::::::::	up to 137	Vulnerable	esm-dev

cpe:2.3:a:esm:esm.sh:*:*:*:*:*:*:*:* Versions up to 137 Vulnerable ·esm-dev

Remediation

Fix · GHSA-p2v6-84h2-5x4r github.com/esm-dev/esm.sh (Go) Fixed in 0.0.0-20250616164159-0593516c4cfa Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-27730
2026-10-03 Alias added: GHSA-p2v6-84h2-5x4r

References

Exploit 1

https://github.com/esm-dev/esm.sh/security/advisories/GHSA-p2v6-84h2-5x4r

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-27730

Other 4

TI-2025-40211 esm.sh CDN service has arbitrary file write via tarslip CVSS 3.1CRITICAL 9.8
TI-2025-32063 esm.sh is vulnerable to full-response SSRF CVSS 4.0HIGH 8.7
TI-2025-40212 esm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScript CVSS 3.1CRITICAL 9.6
TI-2026-19038 esm.sh has path traversal in `extractPackageTarball` that enables file writes from malicious packages CVSS 4.0HIGH 7.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences