TI-2026-32504 Aliases CVE-2026-44593 GHSA-3636-h3vx-6465

esm.sh: Legacy Route Path Traversal Can Lead to RCE

HIGH 77CWE-22Published 2026-05-28 · Updated 2026-06-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: None · High · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

esm.sh is a no-build content delivery network (CDN) for web development. In 137 and earlier, the legacy router first retrieves a response from legacyServer, parses the incoming request path, and ultimately writes the data to storage via buildStorage.Put. The router concatenates the path components without sanitizing them, producing a storage key. When this key is used, the underlying file system resolves the relative segments and writes the file to the specified path. Thus an attacker can craft a request that writes data to arbitrary locations on the server.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00437 38th percentileScored 2026-11-07

Fix Fixed github.com/esm-dev/esm.sh (Go): 0.0.0-20260508100112-1960055e1d53

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
esm-dev	esm.sh	up to 137	—	No fix listed	CNA
—	github.com/esm-dev/esm.sh (Go)	before 0.0.0-20260508100112-1960055e1d53	0.0.0-20260508100112-1960055e1d53	Patch available	GHSA-3636-h3vx-6465

esm.sh Vendoresm-dev Affected up to 137 Fixed in — No fix listed CNA
github.com/esm-dev/esm.sh (Go) Vendor— Affected before 0.0.0-20260508100112-1960055e1d53 Fixed in 0.0.0-20260508100112-1960055e1d53 Patch available GHSA-3636-h3vx-6465

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:esm:esm.sh::::::::	—	—	esm-dev

cpe:2.3:a:esm:esm.sh:*:*:*:*:*:*:*:* Versions — — ·esm-dev

Remediation

Fix · GHSA-3636-h3vx-6465 github.com/esm-dev/esm.sh (Go) Fixed in 0.0.0-20260508100112-1960055e1d53 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-44593
2026-10-03 Alias added: GHSA-3636-h3vx-6465

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-44593

Other 3

TI-2025-40211 esm.sh CDN service has arbitrary file write via tarslip CVSS 3.1CRITICAL 9.8
TI-2025-32063 esm.sh is vulnerable to full-response SSRF CVSS 4.0HIGH 8.7
TI-2025-40212 esm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScript CVSS 3.1CRITICAL 9.6
TI-2025-36902 Local File Inclusion in esm.sh CVSS 4.0HIGH 7.7
TI-2026-32505 esm.sh: Path Traversal via package.json browser field allows reading arbitrary server files CVSS 3.1HIGH 7.5
TI-2026-22092 esm.sh has SSRF localhost/private-network bypass in `/http(s)` module route CVSS 3.1HIGH 7.5

See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences