PT-2026-21936 · Esm.Sh · Esm.Sh

Poppo25 · Published 2026-02-25 · Updated 2026-03-25 · CVE-2026-27730

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions esm.sh versions up to and including 137

Description esm.sh is a content delivery network (CDN) for web development. A server-side request forgery (SSRF) issue (CWE-918) exists in the /http(s) fetch route. The service attempts to prevent requests to localhost or internal targets, but the validation relies on hostname string checks, which can be circumvented using DNS alias domains. This allows an external party to make the esm.sh server fetch internal localhost services.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-27730

GHSA-P2V6-84H2-5X4R

GO-2026-4554

SUSE-SU-2026:1042-1

Affected Products

Esm.Sh

References · 141

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/27xxx/CVE-2026-27730.json · Exploit
• https://github.com/esm-dev/esm.sh/security/advisories/GHSA-p2v6-84h2-5x4r · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p2v6-84h2-5x4r · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1042-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4554 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-27730 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-27730 · Security Note
• https://github.com/esm-dev/esm.sh · Note
• https://github.com/esm-dev/esm.sh/releases/tag/v137 · Note
• https://github.com/esm-dev/esm.sh/commit/0593516c4cfab49ad3b4900416a8432ff2e23eb0 · Note
• https://github.com/esm-dev/esm.sh/pull/1149 · Note
• https://suse.com/security/cve/CVE-2026-2808 · Note
• https://suse.com/security/cve/CVE-2026-29771 · Note
• https://suse.com/security/cve/CVE-2026-31886 · Note
• https://suse.com/security/cve/CVE-2026-27730 · Note