CVE-2026-44593 esm.sh: Legacy Route Path Traversal Can Lead to RCE
Attackers can exploit path traversal in the legacy router to write arbitrary files, potentially leading to remote code execution on the esm.sh server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-44593?
CVE-2026-44593 is a high-severity path traversal vulnerability in esm-dev esm.sh, published on 28 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
esm.sh is a no-build content delivery network (CDN) for web development. In 137 and earlier, the legacy router first retrieves a response from legacyServer, parses the incoming request path, and ultimately writes the data to storage via buildStorage.Put. The router concatenates the path components without sanitizing them, producing a storage key. When this key is used, the underlying file system resolves the relative segments and writes the file to the specified path. Thus an attacker can craft a request that writes data to arbitrary locations on the server.
Weakness: CWE-22
Which versions are affected by CVE-2026-44593?
3 open source packages ship an affected version, including github.com/esm-dev/esm.sh.
| Package | Affected | Fixed in |
|---|---|---|
github.com/esm-dev/esm.sh Go | All versions | 0.0.0-20260508100112-1960055e1d53 |
github.com/esm-dev/esm.sh Go | All versions | 0.0.0-20260508100112-1960055e1d53 |
github.com/esm-dev/esm.sh Go | All versions | 0.0.0-20260508100112-1960055e1d53 |
How do I fix CVE-2026-44593?
Upgrade github.com/esm-dev/esm.sh to 0.0.0-20260508100112-1960055e1d53 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-44593 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-44593 exists.
Sources
Also known as GHSA-3636-h3vx-6465, GO-2026-5071.