PT-2026-40542 · Esm Dev+1 · Esm.Sh+1

Splitline · Published 2026-05-12 · Updated 2026-05-28 · CVE-2026-44593

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions esm.sh versions 137 and earlier

Description The legacy router retrieves a response from legacyServer, parses the request path, and writes data to storage using the buildStorage.Put() function. Because the router concatenates path components without sanitization, it produces a storage key that allows the underlying file system to resolve relative segments. This enables an attacker to craft requests that write data to arbitrary locations on the server, potentially leading to privilege escalation or remote code execution by overwriting critical binaries or scripts.

Recommendations Update to a version later than 137.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-44593

GHSA-3636-H3VX-6465

Affected Products

Esm.Sh

Github.Com/Esm-Dev/Esm.Sh

References · 5

• 🔥 https://github.com/esm-dev/esm.sh/security/advisories/GHSA-3636-h3vx-6465 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-44593 · Security Note
• https://osv.dev/vulnerability/GHSA-3636-h3vx-6465 · Vendor Advisory
• https://github.com/esm-dev/esm.sh · Note
• https://github.com/esm-dev/esm.sh/releases/tag/v137_3 · Note