# CVE-2026-44594: esm-dev esm.sh path traversal in package.json browser field

Source: https://junglewise.ai/threats/cve-2026-44594-esm-dev-esm-sh-path-traversal-in-package-json-browser-field  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-28. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2026-44594 · Severity: high · CVSS 7.5 · Published 2026-05-28

A vulnerability in the esm.sh content delivery network allows attackers to read sensitive files from the server's host filesystem. By publishing a malicious package to npm and requesting it through the service, an attacker could steal configuration files, authentication tokens, and cloud storage credentials. This could lead to a full compromise of the service's infrastructure and customer data.

Technologies: [github.com/esm-dev/esm.sh (Go)](https://junglewise.ai/threats/technologies/github-com-esm-dev-esm-sh). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-44594 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44594 being exploited in the wild.

**How severe is CVE-2026-44594?** High severity, with a CVSS score of 7.5, published 28 May 2026.

**Which products and versions are affected?** Esm-Dev Esm.Sh < 0.0.0-20250616164159-0593516c4cfa, <= 137; github.com/esm-dev/esm.sh (Go) < 0.0.0-20250616164159-0593516c4cfa, SEMVER:introduced=0,fixed=0.0.0-20250616164159-0593516c4cfa.

**Is there a fix for CVE-2026-44594?** Yes. github.com/esm-dev/esm.sh (Go): upgrade to 0.0.0-20250616164159-0593516c4cfa or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44594 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-44594?** Check whether you run Esm-Dev Esm.Sh or github.com/esm-dev/esm.sh (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/esm-dev/esm.sh (Go): upgrade to 0.0.0-20250616164159-0593516c4cfa or later

  ```sh
  go get github.com/esm-dev/esm.sh@v0.0.0-20250616164159-0593516c4cfa
  ```


## Technical details

A Local File Inclusion (LFI) / Path Traversal vulnerability exists in the esbuild plugin within esm.sh's server/build.go. While the plugin initially validates that resolved paths are within the package's working directory, it fails to re-validate paths after they are remapped via the 'browser' field in package.json. An attacker can use '../' sequences in this field to escape the sandbox. The contents of the resulting files are then leaked through the bundled JavaScript output or the 'sourcesContent' array in source maps. This can be used to read sensitive files like config.json, which may contain npm registry tokens or S3 credentials. The vulnerability is patched in version 0.0.0-20250616164159-0593516c4cfa.

## Affected products

- esm-dev esm.sh < 0.0.0-20250616164159-0593516c4cfa

## Identifiers

- CVE-2026-44594
- GHSA-rg65-45m7-hq57
- GO-2026-5620

## Timeline

- 2026-05-08: disclosed
- 2026-05-12: advisory
- 2026-05-28: other: NVD published

## References

- [https://api.github.com/users/donttrytofindme](https://api.github.com/users/donttrytofindme)
- [https://github.com/donttrytofindme](https://github.com/donttrytofindme)
- [https://api.github.com/users/donttrytofindme/gists%7B/gist_id%7D](https://api.github.com/users/donttrytofindme/gists%7B/gist_id%7D)
- [https://api.github.com/users/donttrytofindme/repos](https://api.github.com/users/donttrytofindme/repos)
- [https://avatars.githubusercontent.com/u/274643975?v=4](https://avatars.githubusercontent.com/u/274643975?v=4)
- [https://api.github.com/users/donttrytofindme/events%7B/privacy%7D](https://api.github.com/users/donttrytofindme/events%7B/privacy%7D)

## Related threats

- [esm.sh path traversal in legacy router leads to arbitrary file write](https://junglewise.ai/threats/cve-2026-44593-esm-sh-path-traversal-in-legacy-router-leads-to-arbitrary-file)
- [GO-2026-4554 - esm.sh has SSRF localhost/private-network bypass in `/http(s)` module route in github.com/esm-dev/esm.sh](https://junglewise.ai/threats/cve-2026-27730-esm-sh-has-ssrf-localhost-private-network-bypass-in-http-s-module)
- [GO-2026-4332 - esm.sh has a path traversal in extractPackageTarball enables file writes from malicious packages](https://junglewise.ai/threats/cve-2026-23644-esm-sh-has-a-path-traversal-in-extractpackagetarball-enables-file)
- [GO-2026-4545 - esm.sh is vulnerable to full-response SSRF in github.com/esm-dev/esm.sh](https://junglewise.ai/threats/cve-2025-50180-esm-sh-is-vulnerable-to-full-response-ssrf)
- [GO-2025-4139 - esm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScript in github.com/esm-dev/esm.sh](https://junglewise.ai/threats/cve-2025-65026-esm-sh-cdn-service-has-js-template-literal-injection-in-css-to)