esm.sh is a no-build CDN for web development. In versions 137 and earlier, its legacy router retrieves responses from legacyServer and writes data to storage via buildStorage.Put. The router concatenates path components from incoming requests without sanitizing them, producing a storage key that the file system resolves including relative path segments. This lack of sanitization allows an attacker to perform path traversal, writing files to arbitrary server locations.

An attacker can write files to arbitrary locations on the server hosting esm.sh, potentially leading to unauthorized file modification or system compromise. The vulnerability does not require authentication or user interaction and can be exploited remotely over the network. The CVSS 4.0 base score is 8.7, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected esm.sh versions or implementing external controls to prevent exploitation of path traversal. Monitor vendor channels for updates and apply patches promptly once available.