High severity · published May 28, 2026
CVE-2026-44594
esm.sh: Path Traversal via package.json browser field allows reading arbitrary server files
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
esm.sh is a no-build content delivery network (CDN) for web development. In 137 and earlier, a Local File Inclusion (LFI) vulnerability exists in the esbuild plugin's handling of the browser field in package.json. An attacker can publish an npm package that causes the server to read and return arbitrary files from the host filesystem during the build process.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ES
esm.sh · esm-dev
<= 137 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-44594
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-44594
github.com
https://github.com/esm-dev/esm.sh/security/advisories/GHSA-rg65-45m7-hq57
More from esm.sh
9.8
CVE-2025-65025
esm.sh CDN service has arbitrary file write via tarslip
9.6
CVE-2025-65026
esm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScript
8.7
CVE-2026-44593
esm.sh: Legacy Route Path Traversal Can Lead to RCE
7.7
CVE-2025-59341
Local File Inclusion in esm.sh
7.5
CVE-2026-27730
esm.sh has SSRF localhost/private-network bypass in `/http(s)` module route