CVE-2026-44593
Description
esm.sh is a no-build content delivery network (CDN) for web development. In 137 and earlier, the legacy router first retrieves a response from legacyServer, parses the incoming request path, and ultimately writes the data to storage via buildStorage.Put. The router concatenates the path components without sanitizing them, producing a storage key. When this key is used, the underlying file system resolves the relative segments and writes the file to the specified path. Thus an attacker can craft a request that writes data to arbitrary locations on the server.
How to fix
- github.com/esm-dev/esm.sh0.0.0-20260508100112-1960055e1d53 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| github.com/esm-dev/esm.shGo | v < 0.0.0-20260508100112-1960055e1d53 | 0.0.0-20260508100112-1960055e1d53 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.