CVE-2026-23644 esm.sh has path traversal in `extractPackageTarball` that enables file writes from malicious packages
Attackers can write arbitrary files via malicious packages due to path traversal in esm.sh, requiring a patch to prevent unauthorized file modifications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23644?
CVE-2026-23644 is a high-severity path traversal vulnerability in esm-dev esm.sh, published on 18 Jan 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
esm.sh is a no-build content delivery network (CDN) for web development. Prior to Go pseeudoversion 0.0.0-20260116051925-c62ab83c589e, the software has a path traversal vulnerability due to an incomplete fix. `path.Clean` normalizes a path but does not prevent absolute paths in a malicious tar file. Commit https://github.com/esm-dev/esm.sh/commit/9d77b88c320733ff6689d938d85d246a3af9af16, corresponding to pseudoversion 0.0.0-20260116051925-c62ab83c589e, fixes this issue.
Weakness: CWE-22
Which versions are affected by CVE-2026-23644?
5 open source packages ship an affected version, including github.com/esm-dev/esm.sh. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/esm-dev/esm.sh Go | All versions | 0.0.0-20260116051925-c62ab83c589e |
github.com/esm-dev/esm.sh Go | All versions | 0.0.0-20260116051925-c62ab83c589e |
github.com/esm-dev/esm.sh Go | All versions | 0.0.0-20260116051925-c62ab83c589e |
github.com/esm-dev/esm.sh Go | From 0.0.1 to 136 | None |
github.com/esm-dev/esm.sh Go | From 0.0.1 to 136 | None |
Products include Esm Esm.sh.
How do I fix CVE-2026-23644?
Upgrade github.com/esm-dev/esm.sh to 0.0.0-20260116051925-c62ab83c589e or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-23644 being exploited?
There is no known exploitation of CVE-2026-23644 in the wild and no public exploit code.
Other vulnerabilities in esm-dev esm.sh
- CVE-2025-50180 esm.sh is vulnerable to full-response SSRF
- CVE-2026-27730 esm.sh has SSRF localhost/private-network bypass in `/http(s)` module route
- CVE-2025-65025 esm.sh CDN service has arbitrary file write via tarslip
- CVE-2025-65026 esm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScript
Sources
Also known as GHSA-2657-3c98-63jq, GO-2026-4332.