esm.sh, a no-build CDN for web development, contains a path traversal vulnerability (CWE-22) in its legacy router component in versions up to 137. The router retrieves a response from legacyServer, parses the request path, and concatenates path components without sanitization to form a storage key. This key is used in buildStorage.Put to write data to storage. Due to lack of path sanitization, relative path segments can cause the filesystem to write files outside the intended directory, allowing an attacker to write data to arbitrary server locations.

An attacker can exploit this vulnerability to write files to arbitrary locations on the server hosting esm.sh. This could lead to unauthorized modification or creation of files, potentially compromising server integrity or enabling further attacks. The CVSS 4.0 score is 8.7 (high), reflecting network attack vector, no required privileges or user interaction, and high impact on integrity. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the legacy router functionality if possible, or implement external controls to validate and sanitize request paths before they reach esm.sh. Monitor vendor communications for updates on patches or official mitigations.