CVE-2026-44594

esm.sh is a no-build content delivery network (CDN) for web development. In 137 and earlier, a Local File Inclusion (LFI) vulnerability exists in the esbuild plugin's handling of the browser field in package.json. An attacker can publish an npm package that causes the server to read and return arbitrary files from the host filesystem during the build process.

• CWE-22

• https://github.com/esm-dev/esm.sh/security/advisories/GHSA-rg65-45m7-hq57
• https://github.com/esm-dev/esm.sh/security/advisories/GHSA-rg65-45m7-hq57

Published

May 28, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-44588SiYuan is an open-source personal knowledge management syste…9.4
• CVE-2026-44589Nuxt OG Image generates OG Images with Vue templates in Nuxt…3.7
• CVE-2026-4459Out of bounds read and write in WebAudio in Google Chrome pr…8.8
• CVE-2026-44590Sherlock hunts down social media accounts by username across…9.3
• CVE-2026-44592Gradient is a nix-based continuous integration system. In 1.…9.4
• CVE-2026-44593esm.sh is a no-build content delivery network (CDN) for web …8.7
• CVE-2026-44595Yamcs is a mission control framework. Prior to 5.12.7, the I…4.3
• CVE-2026-44596Yamcs is a mission control framework. Prior to 5.12.7, the a…9.8
• CVE-2026-44597Tor before 0.4.9.7 has an out-of-bounds read when an END, a …9.1
• CVE-2026-44598With valid login credentials, URL Redirection to Untrusted S…5.4
• CVE-2026-44599Tor before 0.4.9.7 can attempt or accept BEGIN_DIR via confl…5.3
• CVE-2026-4460Out of bounds read in Skia in Google Chrome prior to 146.0.7…8.8