CVE-2026-44594CWE-22

esm.sh: Path Traversal via package.json browser field allows reading arbitrary server files

High · published May 28, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
40.5
In the wild
Unconfirmed
What it is

esm.sh is a no-build content delivery network (CDN) for web development. In 137 and earlier, a Local File Inclusion (LFI) vulnerability exists in the esbuild plugin's handling of the browser field in package.json. An attacker can publish an npm package that causes the server to read and return arbitrary files from the host filesystem during the build process.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00481 · 40.5th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-05-28T14:45Z
EPSS history
Timeline
  • 28 MAY 14:45Z
    esm.sh: Path Traversal via package.json browser field allows reading arbitrary server files
    cvelistv5