{"id":"EUVD-2026-32910","enisaUuid":"18243287-7faa-367f-a921-08c015df2777","description":"esm.sh is a no-build content delivery network (CDN) for web development. In 137 and earlier, the legacy router first retrieves a response from legacyServer, parses the incoming request path, and ultimately writes the data to storage via buildStorage.Put. The router concatenates the path components without sanitizing them, producing a storage key. When this key is used, the underlying file system resolves the relative segments and writes the file to the specified path. Thus an attacker can craft a request that writes data to arbitrary locations on the server.","datePublished":"May 28, 2026, 2:44:20 PM","dateUpdated":"Jun 2, 2026, 3:01:05 PM","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/esm-dev/esm.sh/security/advisories/GHSA-3636-h3vx-6465\n","aliases":"CVE-2026-44593\nGHSA-3636-h3vx-6465\n","assigner":"GitHub_M","epss":0.44,"enisaIdProduct":[{"id":"4854d2f8-fb55-396a-b724-457d48f9c0f5","product":{"name":"esm.sh","vendor":{"name":"esm-dev"}},"product_version":"≤ 137"}],"enisaIdVendor":[{"id":"6f7094a3-fd90-3509-857e-5d12eee9753f","vendor":{"name":"esm-dev"}}],"enisaIdVulnerability":[{"id":"0e74a4a4-3ed7-3ced-b334-7263b200c730","vulnerability":{"id":"CVE-2026-44593","description":"esm.sh is a no-build content delivery network (CDN) for web development. In 137 and earlier, the legacy router first retrieves a response from legacyServer, parses the incoming request path, and ultimately writes the data to storage via buildStorage.Put. The router concatenates the path components without sanitizing them, producing a storage key. When this key is used, the underlying file system resolves the relative segments and writes the file to the specified path. Thus an attacker can craft a request that writes data to arbitrary locations on the server.","datePublished":"May 28, 2026, 2:44:20 PM","dateUpdated":"Jun 2, 2026, 3:01:05 PM","status":"PUBLISHED","baseScore":8.7,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/esm-dev/esm.sh/security/advisories/GHSA-3636-h3vx-6465\n","enisa_id":"EUVD-2026-32910\n","assigner":"GitHub_M","epss":0.44,"dataProcessed":"Nov 7, 2026, 7:21:46 AM","vulnerabilityProduct":[{"id":"39ea4a00-25ac-3f9d-bcd9-9cf3584653bb","product":{"name":"esm.sh","vendor":{"name":"esm-dev"}},"product_version":"≤ 137"}],"vulnerabilityVendor":[{"id":"1e33e220-e877-3ac3-b8d6-757d1a31ebb6","vendor":{"name":"esm-dev"}}]}},{"id":"f111092e-bdac-3b82-bc76-86680e35ab68","vulnerability":{"id":"GHSA-3636-h3vx-6465","description":"esm.sh: Legacy Route Path Traversal Can Lead to RCE","datePublished":"May 12, 2026, 10:22:39 PM","dateUpdated":"Jun 9, 2026, 1:59:36 AM","baseScore":0.0,"references":"https://github.com/esm-dev/esm.sh/security/advisories/GHSA-3636-h3vx-6465\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-44593\nhttps://github.com/esm-dev/esm.sh\nhttps://github.com/esm-dev/esm.sh/releases/tag/v137_3\n","enisa_id":"EUVD-2026-32910\n","aliases":"GHSA-3636-h3vx-6465\nCVE-2026-44593\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:00:21 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}