esm.sh hat eine Pfadüberschreitung in extractPackageTarball, die Dateioperationen aus bösartigen Paketen ermöglicht

The core of the vulnerability lies in the inadequate handling of paths within tarball archives. While a previous commit attempted to address this, it failed to fully prevent absolute paths within malicious tar files from being resolved. An attacker could craft a specially designed tarball containing paths like /../../../../etc/passwd or similar constructs. When esm.sh extracts this tarball, it could inadvertently expose sensitive files, including configuration files, source code, or even system files. The potential impact extends beyond simple information disclosure; depending on the server's configuration and permissions, an attacker might be able to modify or delete files, leading to a complete compromise of the system. This vulnerability shares similarities with other path traversal exploits where attackers leverage improper path sanitization to gain unauthorized access.

Applications and services that rely on esm.sh to load JavaScript modules are at risk. This includes projects using esm.sh as a CDN or module resolver. Developers who have integrated esm.sh into their build processes or deployment pipelines should prioritize upgrading to the patched version.

• linux / server:

journalctl -u esm.sh -f | grep -i "path traversal"

• generic web:

curl -I <esm.sh_endpoint> | grep -i "path traversal"

1. 2026-01-20Disclosure

   disclosure

1. Reserviert2026-01-14
2. Veröffentlicht2026-01-20
3. Geändert2026-02-27
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-23644 is to upgrade to the patched version, 0.0.0-20260116051925-c62ab83c589e. If an immediate upgrade is not feasible due to compatibility issues or breaking changes, consider implementing temporary workarounds. One approach is to restrict the directories from which esm.sh can resolve modules, limiting the potential blast radius of a successful exploit. Additionally, a Web Application Firewall (WAF) or reverse proxy could be configured to inspect incoming requests for suspicious path patterns and block those that attempt to traverse outside of the expected directory structure. Regularly review and update the esm.sh configuration to ensure it adheres to security best practices.