Security readout for executives and security teams
Plain-English summary
CVE-2026-23644 affects esm.sh, a CDN used for no-build web development. A malicious package tarball can abuse path handling during extraction to write files outside the intended location. For organizations running esm.sh infrastructure, this is a high-priority server-side issue because exploitation requires no authentication or user interaction.
Executive priority
Treat as urgent for teams self-hosting esm.sh or running package-processing infrastructure. The issue is remotely reachable and unauthenticated in scoring, but current sources do not confirm active exploitation. Prioritize upgrade and exposure review over broad emergency response.
Technical view
The flaw is CWE-22 path traversal in esm.sh extractPackageTarball before Go pseudoversion 0.0.0-20260116051925-c62ab83c589e. The advisory says an incomplete fix used path.Clean, which normalizes paths but does not block absolute paths in malicious tar files. The fix is associated with commit 9d77b88c320733ff6689d938d85d246a3af9af16 / c62ab83c589e.
Likely exposure
Exposure is likely limited to organizations operating affected esm.sh versions that ingest or extract package tarballs, especially from untrusted package sources. Users only consuming the public esm.sh service are not identified as affected in the provided sources.
Exploitation context
The CVSS v4.0 score is 7.7 with network attack vector, low complexity, no privileges, and no user interaction. The provided bundle does not show CISA KEV listing or confirmed active exploitation. The CVSS vector includes E:P, indicating proof-of-concept maturity in the scoring data.
Researcher notes
Focus review on tar extraction path validation and handling of absolute paths. The core issue is that path.Clean alone is insufficient as a security boundary. Avoid assuming impact beyond esm.sh versions listed in the advisory and Go vulnerability database.
Mitigation direction
- Upgrade esm.sh to pseudoversion 0.0.0-20260116051925-c62ab83c589e or later.
- Review the GitHub advisory and linked fix commits before deploying.
- If immediate upgrade is not possible, restrict ingestion of untrusted package tarballs.
- Monitor vendor guidance for any additional operational mitigations.
Validation and detection
- Inventory self-hosted esm.sh deployments and identify their exact Go module pseudoversion.
- Confirm deployed code includes commit c62ab83c589e or the linked fix commit.
- Review logs for unexpected package extraction errors or suspicious file write behavior.
- Validate package ingestion paths are limited to trusted sources where practical.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-22: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupFile access behavior lookup
The CVE wording references file access or upload behavior, so file telemetry and web shell review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-23644 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.7 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
7.7HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/esm-dev/esm.sh/security/advisories/GHSA-2657-3c98-63jqCVE reference · x_refsource_CONFIRM
- https://github.com/esm-dev/esm.sh/commit/9d77b88c320733ff6689d938d85d246a3af9af16CVE reference · x_refsource_MISC
- https://github.com/esm-dev/esm.sh/commit/c62ab83c589e7b421a0e1376d2a00a4e48161093CVE reference · x_refsource_MISC
- https://pkg.go.dev/vuln/GO-2025-4138CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.