CVE-2026-44593: esm.sh: Legacy Route Path Traversal Can Lead to RCE

Synopsis

A path traversal vulnerability in esm.sh (versions 137 and earlier) allows an unauthenticated remote attacker to write arbitrary files to the server's file system through the legacy router. The router concatenates user-supplied path components without sanitizing relative segments such as "../", and the resulting storage key is passed directly to the underlying file system. Successful exploitation gives the attacker the ability to overwrite or create files at arbitrary paths on the server, which can be chained into remote code execution. HarborGuard tracks the upstream advisory and will make a patched-image rebuild available the moment a fix version is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the esm.sh legacy router over the network; no prior foothold on the host is needed.

• AuthenticationNot required

  No credentials or account are required; the vulnerable legacy route accepts unauthenticated requests.

• Victim interactionNot required

  The attacker sends a crafted HTTP request directly to the server; no user action or social engineering is involved.

• Attack complexityDetail

  Exploitation is reliable and condition-free: constructing a path-traversal payload requires no race conditions, memory layout knowledge, or environmental prerequisites.

Blast Radius

• Writes arbitrary files to any path the server process can reach on the host file system.
• Overwrites configuration files, startup scripts, or web-served assets, enabling remote code execution by placing attacker-controlled content where it will be executed or interpreted.
• Corrupts or replaces stored build artifacts and cached modules served to downstream consumers of the CDN.