CVE-2026-44594: esm.sh: Path Traversal via package.json browser field allows reading arbitrary server files

Synopsis

A path traversal (Local File Inclusion) vulnerability exists in esm.sh, a no-build CDN for web development, versions 137 and earlier. The flaw is reachable over the network with no authentication required: an attacker publishes a crafted npm package whose package.json browser field causes the server's esbuild plugin to read arbitrary files from the host filesystem during a build. Successful exploitation gives the attacker read access to any file the server process can reach, including configuration files, secrets, and other sensitive data. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the esm.sh service over the network, as the attack vector is network-exposed (AV:N).

• AuthenticationNot required

  No account or credential is needed; the attacker triggers the vulnerability by publishing a malicious npm package without any authentication to the target server (PR:N).

• Victim interactionNot required

  No user action is required on the server side; the malicious package is processed automatically during the build pipeline (UI:N).

• Attack complexityDetail

  Attack complexity is low (AC:L), meaning the exploit is reliable and requires no special timing, race conditions, or environment-specific preconditions beyond publishing a crafted package.

Blast Radius

• The attacker reads arbitrary files from the host filesystem that the server process has permission to access, including private keys, API credentials, and environment variable files.
• Configuration files such as database connection strings or cloud provider credentials stored on the host can be exfiltrated.
• Any secrets injected into the container at runtime (e.g., mounted Kubernetes secrets or .env files) are exposed if they exist on the filesystem.