esm.sh heeft een SSRF localhost/private-network omzeiling in de `/http(s)` module route in github.com/esm-dev/esm.sh

The SSRF vulnerability in esm.sh presents a significant risk because it enables attackers to craft malicious requests that originate from the server itself. By exploiting the /http(s) module route, an attacker can bypass intended security boundaries and access resources that should be inaccessible from external networks. This could include internal APIs, databases, or other sensitive services residing on the same network as the esm.sh server. Successful exploitation could lead to data exfiltration, privilege escalation, or even remote code execution if the accessed internal services are vulnerable. The ability to bypass localhost restrictions is particularly concerning, as it allows attackers to interact with services running on the same machine as esm.sh.

Organizations that rely on esm.sh for JavaScript module loading, particularly those deploying esm.sh within internal networks or behind firewalls, are at risk. Shared hosting environments where multiple users share the same esm.sh instance are also particularly vulnerable, as a compromised user could potentially exploit the SSRF vulnerability to access resources belonging to other users.

• linux / server: Monitor access logs for outbound requests to internal IP addresses or services via the /http(s) endpoint. Use journalctl -u esm.sh to check for unusual activity.

 grep -i 'internal_ip_address' /var/log/esm.sh/access.log

• generic web: Use curl to test the /http(s) endpoint with internal URLs.

curl http://localhost:8080/http://127.0.0.1:8081/  # Example internal URL

• go: Examine the esm.sh source code for the /http(s) module route to identify potential vulnerabilities and ensure proper input validation is implemented.

1. 2026-02-27Disclosure

   disclosure

1. Gereserveerd2026-02-23
2. Gepubliceerd2026-02-27
3. Gewijzigd2026-03-09
4. EPSS bijgewerkt2026-03-23

The primary mitigation for CVE-2026-27730 is to immediately upgrade to version 0.0.0-20250616164159-0593516c4cfa or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing temporary workarounds. These might include restricting outbound network access from the esm.sh server to only trusted destinations, or implementing strict input validation on the /http(s) module route to prevent malicious URLs. Additionally, monitor access logs for unusual outbound requests originating from the esm.sh server. After upgrading, verify the fix by attempting to access internal resources via the /http(s) route and confirming that access is denied.