CVE-2026-23644: Path Traversal in esm.sh

The core of the vulnerability lies in the inadequate handling of absolute paths within tar archives. While a previous commit attempted to address this issue, it failed to fully prevent malicious actors from exploiting path traversal techniques. An attacker could construct a specially crafted tar file containing paths designed to escape the intended extraction directory. This could allow them to read sensitive configuration files, source code, or even execute arbitrary code if the server is configured to process such files. The blast radius extends to any system utilizing esm.sh to load JavaScript modules, potentially exposing a wide range of applications and services.

1. Reserved2026-01-14
2. Published2026-01-20
3. Modified2026-02-27
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-23644 is to immediately upgrade to version 0.0.0-20260116051925-c62ab83c589e or later. If upgrading is not immediately feasible, consider implementing temporary workarounds such as restricting the types of files that esm.sh is allowed to serve or implementing stricter input validation on any user-provided paths. Web application firewalls (WAFs) configured to detect path traversal attempts could also provide an additional layer of defense. Monitor system logs for unusual file access patterns that might indicate exploitation.