Path Traversal Vulnerability in esm.sh Content Delivery Network
CVE-2026-44593

8.7HIGH

Key Information:

Vendor

Esm-dev

Status
Esm.sh
Vendor
CVE Published:
28 May 2026

What is CVE-2026-44593?

The esm.sh Content Delivery Network, utilized for web development, contains a path traversal vulnerability that arises from improper handling of request paths. In versions up to and including 137, the system's legacy router retrieves and parses request paths to construct storage keys without sanitization. This flaw allows attackers to manipulate the input, potentially writing data to unauthorized locations within the server's file system, thereby impacting data integrity and security. Attackers can exploit this vulnerability to gain access to sensitive information or disrupt service by altering files within critical directories.

Affected Version(s)

esm.sh <= 137

References

https://github.com/esm-dev/esm.sh/security/advisories/GHS...
x_refsource_CONFIRM

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.