Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-44594 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

esm.sh is a no-build content delivery network (CDN) for web development. In 137 and earlier, a Local File Inclusion (LFI) vulnerability exists in the esbuild plugin's handling of the browser field in package.json. An attacker can publish an npm package that causes the server to read and return arbitrary files from the host filesystem during the build process.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:8.6 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

CNA: [email protected]CVSS-B:7.5 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/esm-dev/esm.sh/security/advisories/GHSA-rg65-45m7-hq57	CISA-ADP	AdvisoryExploitRemedyVendor
https://github.com/esm-dev/esm.sh/security/advisories/GHSA-rg65-45m7-hq57	[email protected]	AdvisoryExploitRemedyVendor

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-22	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')	[email protected]

Affected Products

Product	Versions
esm.sh	<= 137
CPE No CPEs found in CPE dictionary for this product. Remediation No remediation found in references.

Change History

4 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	[email protected]
Jun 17, 2026	CVE Modified	CISA-ADP
May 28, 2026	CVE Modified	CISA-ADP
May 28, 2026	New CVE Received	[email protected]