CVE-2026-44594

Published: May 28, 2026Modified: Jun 17, 2026Deferred

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: security-advisories@github.com (Secondary)

Description

esm.sh is a no-build content delivery network (CDN) for web development. In 137 and earlier, a Local File Inclusion (LFI) vulnerability exists in the esbuild plugin's handling of the browser field in package.json. An attacker can publish an npm package that causes the server to read and return arbitrary files from the host filesystem during the build process.

Related CWEs

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (2)

https://github.com/esm-dev/esm.sh/security/advisories/GHSA-rg65-45m7-hq57

Source: security-advisories@github.com

https://github.com/esm-dev/esm.sh/security/advisories/GHSA-rg65-45m7-hq57

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.