Is CVE-2026-44594 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44594 being exploited in the wild.

How severe is CVE-2026-44594?

High severity, with a CVSS score of 7.5, published 28 May 2026.

Which products and versions are affected?

Esm-Dev Esm.Sh < 0.0.0-20250616164159-0593516c4cfa, <= 137; github.com/esm-dev/esm.sh (Go) < 0.0.0-20250616164159-0593516c4cfa, SEMVER:introduced=0,fixed=0.0.0-20250616164159-0593516c4cfa.

Is there a fix for CVE-2026-44594?

Yes. github.com/esm-dev/esm.sh (Go): upgrade to 0.0.0-20250616164159-0593516c4cfa or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44594 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-44594?

Check whether you run Esm-Dev Esm.Sh or github.com/esm-dev/esm.sh (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44594: esm-dev esm.sh path traversal in package.json browser field

Q: Which products and versions are affected?

Esm-Dev Esm.Sh < 0.0.0-20250616164159-0593516c4cfa, <= 137; github.com/esm-dev/esm.sh (Go) < 0.0.0-20250616164159-0593516c4cfa, SEMVER:introduced=0,fixed=0.0.0-20250616164159-0593516c4cfa.

Q: Is there a fix for CVE-2026-44594?

Yes. github.com/esm-dev/esm.sh (Go): upgrade to 0.0.0-20250616164159-0593516c4cfa or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-44594 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-44594?

Check whether you run Esm-Dev Esm.Sh or github.com/esm-dev/esm.sh (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44594 · Severity: high · CVSS 7.5 · Published 2026-05-28

A vulnerability in the esm.sh content delivery network allows attackers to read sensitive files from the server's host filesystem. By publishing a malicious package to npm and requesting it through the service, an attacker could steal configuration files, authentication tokens, and cloud storage credentials. This could lead to a full compromise of the service's infrastructure and customer data.

Technologies: github.com/esm-dev/esm.sh (Go). Vendors: Go.

Quick answers

Is CVE-2026-44594 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44594 being exploited in the wild.
How severe is CVE-2026-44594?: High severity, with a CVSS score of 7.5, published 28 May 2026.
Which products and versions are affected?: Esm-Dev Esm.Sh < 0.0.0-20250616164159-0593516c4cfa, <= 137; github.com/esm-dev/esm.sh (Go) < 0.0.0-20250616164159-0593516c4cfa, SEMVER:introduced=0,fixed=0.0.0-20250616164159-0593516c4cfa.
Is there a fix for CVE-2026-44594?: Yes. github.com/esm-dev/esm.sh (Go): upgrade to 0.0.0-20250616164159-0593516c4cfa or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44594 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-44594?: Check whether you run Esm-Dev Esm.Sh or github.com/esm-dev/esm.sh (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/esm-dev/esm.sh (Go): upgrade to 0.0.0-20250616164159-0593516c4cfa or later
```
go get github.com/esm-dev/esm.sh@v0.0.0-20250616164159-0593516c4cfa
```

Technical details

A Local File Inclusion (LFI) / Path Traversal vulnerability exists in the esbuild plugin within esm.sh's server/build.go. While the plugin initially validates that resolved paths are within the package's working directory, it fails to re-validate paths after they are remapped via the 'browser' field in package.json. An attacker can use '../' sequences in this field to escape the sandbox. The contents of the resulting files are then leaked through the bundled JavaScript output or the 'sourcesContent' array in source maps. This can be used to read sensitive files like config.json, which may contain npm registry tokens or S3 credentials. The vulnerability is patched in version 0.0.0-20250616164159-0593516c4cfa.

Affected products

esm-dev esm.sh < 0.0.0-20250616164159-0593516c4cfa

Identifiers

CVE-2026-44594
GHSA-rg65-45m7-hq57
GO-2026-5620

Timeline

2026-05-08: disclosed
2026-05-12: advisory
2026-05-28: other: NVD published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.