CVE-2026-44594

Technical summary

CVE-2026-44594 is a Local File Inclusion (CWE-22) vulnerability in esm.sh version 137 and earlier, affecting the esbuild plugin's package.json parser. When processing the 'browser' field—a standard npm package metadata field—the plugin fails to properly sanitize path inputs, allowing path traversal attacks. An attacker can craft a malicious npm package with a specially constructed 'browser' field value that causes the server to read arbitrary files from the host filesystem during the bundling process. The accessed file contents are returned to the attacker, enabling disclosure of configuration files, private keys, source code, or other sensitive data residing on the cdn's servers. The vulnerability requires no authentication and can be triggered remotely by publishing to npm.

Business impact

Organizations and developers relying on esm.sh for production JavaScript delivery face information disclosure risks. If an attacker successfully exploits this vulnerability, they could potentially access environment variables, API credentials, private keys, or proprietary source code stored on esm.sh's infrastructure. This could lead to lateral attacks against downstream customers, compromise of the supply chain, or theft of intellectual property. The impact extends to any project using esm.sh in its build or development workflow, as the malicious package can be introduced either directly or as a transitive dependency. However, the actual business impact depends on what sensitive data esm.sh stores on affected servers and whether attackers can correlate leaked information with specific organizations.

Affected systems

esm.sh version 137 and earlier are directly affected. The vulnerability is triggered during the package resolution and bundling phase, so any build or deployment process that uses esm.sh to resolve or serve npm packages is potentially vulnerable. Developers using esm.sh in development environments or as part of CI/CD pipelines may be at elevated risk, particularly if the pipeline runs on shared infrastructure. End users consuming JavaScript bundles *served* by esm.sh (not built locally with it) are not directly vulnerable, as the attack occurs server-side during the build process itself.

Exploitability

This vulnerability is relatively straightforward to exploit. An attacker needs only to publish a malicious package to npm—a public, free action—and wait for esm.sh to process it, either through direct requests or through dependency resolution. The attack requires no authentication, no user interaction, and network access is trivial for a public CDN. The only complexity lies in discovering which files exist on the target server and crafting effective path traversal payloads, but this is a well-understood technique. However, practical exploitation impact is somewhat mitigated by the attacker's uncertainty about what sensitive data actually resides on the server and whether leaked information is useful without additional context. Nonetheless, the CVSS score of 7.5 (HIGH) reflects the ease of exploitation and the severity of potential information disclosure.

Remediation

Upgrade esm.sh to a patched version released after version 137. Verify the exact patched version against the official esm.sh repository or security advisory. The remediation involves sanitizing and validating all path inputs derived from package.json fields, particularly the 'browser' field, to prevent path traversal attacks. Implement strict path resolution policies that confine file access to intended package directories and prevent traversal outside those boundaries. Additionally, consider implementing input validation on npm package metadata before processing.

Patch guidance

Check the official esm.sh GitHub repository for security advisories and available patches. Upgrade to the latest version released after CVE-2026-44594 was disclosed (post-May 28, 2026). If you operate an esm.sh deployment, prioritize updating the esbuild plugin and core bundling logic. For development teams using esm.sh: if you maintain your own esm.sh instance, apply patches immediately. If you rely on the public esm.sh service, verify that the upstream service has been patched by checking their status page or release notes. Consider using a version lock or dependency pinning strategy to prevent automatic pulls of malicious packages during the interim.

Detection guidance

Monitor esm.sh server logs for unusual file access patterns or path traversal attempts in package.json parsing. Look for requests containing '../' sequences or absolute path traversals in the 'browser' field of processed packages. If you operate esm.sh infrastructure, audit recent package processing events to identify potentially malicious payloads. On the npm side, security teams can monitor for packages with suspicious or obfuscated 'browser' field entries, especially newly published packages or those with unusual names. Implement runtime checks to alert when esm.sh attempts to read files outside expected package directories. Network-based detection is limited, as exploitation occurs during server-side bundling, but IDS/IPS rules detecting path traversal in HTTP request bodies may catch some variants.

Why prioritize this

Despite not being listed on CISA's KEV catalog, this vulnerability merits immediate prioritization due to its HIGH severity rating, ease of exploitation, and supply-chain implications. The attack surface is global—any organization or developer using esm.sh can be targeted without prior compromise or specialized access. The confidentiality impact is significant; an attacker can exfiltrate sensitive data from cdn infrastructure, potentially affecting multiple downstream users. While the attack requires publishing a malicious package, this is a low-barrier action. Organizations should prioritize patching esm.sh infrastructure and reviewing any sensitive data that might have been exposed.

Risk score, explained

The CVSS v3.1 score of 7.5 (HIGH) reflects: Attack Vector Network (AV:N) - remotely exploitable with no special network conditions; Attack Complexity Low (AC:L) - no special conditions or race conditions required; Privileges Required None (PR:N) - no authentication needed; User Interaction None (UI:N) - the exploit triggers automatically when esm.sh processes the malicious package; Scope Unchanged (S:U) - impact is confined to the vulnerable component; Confidentiality High (C:H) - arbitrary files can be read; Integrity None (I:N) - no ability to modify data; Availability None (A:N) - no denial-of-service impact. The score appropriately reflects that this is an information disclosure vulnerability with trivial exploitation but not the highest impact, as it does not enable code execution, lateral movement, or service disruption on its own.

Frequently asked questions