Executive brief
esm.sh is a content delivery network (CDN) for JavaScript modules. A vulnerability in its legacy routing component allows an attacker to write files to any location on the server's filesystem. This could be used to overwrite critical system files or scripts, potentially allowing an attacker to take full control of the server or disrupt its operations.
Technical details
A path traversal vulnerability exists in the legacy router of esm.sh due to insufficient sanitization of request paths before they are used as storage keys. The `legacy_router.go` component concatenates path components from incoming URLs and passes them to `buildStorage.Put`. An attacker can craft a URL containing URL-encoded path traversal sequences (e.g., %2f..%2f) that, when normalized by the underlying filesystem, resolve to arbitrary locations. By fetching a malicious file from a remote repository and triggering this traversal, an attacker can overwrite arbitrary binaries or scripts on the server, leading to Remote Code Execution (RCE). The vulnerability is fixed in version 0.0.0-20260508100112-1960055e1d53.
Affected products
- esm-dev esm.sh < 0.0.0-20260508100112-1960055e1d53
Timeline
- 2026-05-08: patched: Fix version 0.0.0-20260508100112-1960055e1d53 released.
- 2026-05-12: advisory: GitHub Advisory GHSA-3636-h3vx-6465 published.
- 2026-05-28: disclosed: NVD publication date.