PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-44593 esm-dev CVE debrief

CVE-2026-44593 is a high-severity path traversal vulnerability in esm.sh, a no-build CDN for web development, affecting version 137 and earlier. The vulnerability exists in the legacy router component, which retrieves responses from legacyServer and writes data to storage via buildStorage.Put. The router concatenates path components without sanitization to produce a storage key, allowing the underlying file system to resolve relative path segments. An attacker can craft a request that writes data to arbitrary locations on the server. The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The issue was disclosed on 2026-05-28 with a CVSS 4.0 score of 8.7 (HIGH severity).

Vendor
esm-dev
Product
esm.sh
CVSS
HIGH 8.7
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-06-02
Advisory published
2026-05-28
Advisory updated
2026-06-02

Who should care

Organizations running self-hosted esm.sh instances at version 137 or earlier; developers using esm.sh CDN infrastructure; security teams monitoring supply chain and build infrastructure components.

Technical summary

The esm.sh legacy router constructs storage keys by concatenating URL path components without sanitization. When buildStorage.Put uses this key, the file system resolves relative path segments (e.g., ../), enabling writes outside intended directories. Attackers can exploit this by crafting requests with traversal sequences to overwrite arbitrary files.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade esm.sh to a version newer than 137 that contains the security fix
  • Review storage write operations in legacy router implementations for path sanitization
  • Implement input validation to sanitize path components before storage key generation
  • Audit file system permissions to restrict write access to sensitive directories
  • Monitor for anomalous write operations to unexpected file system locations
  • Review application logs for requests containing path traversal sequences (../, .., etc.)

Evidence notes

Vulnerability description sourced from official CVE record and NVD entry. Technical details confirmed via GitHub Security Advisory GHSA-3636-h3vx-6465. CVSS vector indicates network attack vector with low attack complexity, no privileges required, and high integrity impact.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-44593 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-44593

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-44593 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-44593

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.