esm.sh is a no-build CDN for web development. Versions 137 and earlier contain a CWE-22 path traversal vulnerability in the esbuild plugin's processing of the browser field in package.json. This flaw allows an attacker to craft an npm package that triggers the server to read arbitrary files on the host filesystem during build time, resulting in Local File Inclusion. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability is publicly known but lacks an official fix or patch at this time.

Successful exploitation allows an unauthenticated attacker to cause the esm.sh server to read and disclose arbitrary files from its host filesystem. This can lead to exposure of sensitive information, potentially compromising confidentiality. There is no indication of impact on integrity or availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid using esm.sh versions 137 and earlier in untrusted environments or with unverified npm packages. Monitor esm-dev vendor communications for updates on remediation.