CVE-2026-23644: 
vulnerability analysis and mitigation

CVE-2026-23644 is a path traversal vulnerability in esm.sh, a no-build CDN for web development, affecting the extractPackageTarball function. The vulnerability stems from an incomplete fix for a prior path traversal issue (GO-2025-4138): the use of path.Clean normalizes paths but fails to prevent absolute paths embedded in malicious tar files. All versions prior to Go pseudoversion 0.0.0-20260116051925-c62ab83c589e (esm.sh build < v136) are affected. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 score of 7.7 (High) (GitHub Advisory, NVD). The vulnerability was published on January 18, 2026, and patched on January 16, 2026.

The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), specifically in the extractPackageTarball function in server/npmrc.go. The prior fix applied path.Clean to tar entry names, which normalizes relative path components (e.g., ../) but does not strip or reject absolute paths (e.g., /../../../bad/bad.txt). When esm.sh processes a package tarball containing such entries, the resulting file path escapes the intended installation directory, allowing writes to arbitrary filesystem locations. The attack is network-accessible, requires no authentication or user interaction, and can be triggered by serving a malicious npm-compatible package to the esm.sh instance. A proof-of-concept test case demonstrating the bypass using a crafted gzipped tar with an absolute-path entry was included in the advisory (GitHub Advisory, Fix Commit).

Successful exploitation allows an attacker to write files to arbitrary locations on the server running esm.sh, bypassing directory restrictions during package extraction. At minimum, this enables overwriting the esm.sh configuration file and poisoning cached packages, which could affect all users of a self-hosted instance. In certain deployment configurations, arbitrary file writes could escalate to server-side code execution — for example, by writing to cron files or other executable paths — though the default deployment's file-extension allowlist and non-root process execution limit the most direct escalation paths. Confidentiality impact is rated None by NVD (v3.1), while integrity impact is rated High, reflecting the primary risk of unauthorized file modification (GitHub Advisory).

A proof-of-concept exploit is publicly referenced via the Go vulnerability database (GO-2025-4138) and was included in the security advisory as a test case (Go Vuln DB, GitHub Advisory). There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.047% (low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The CVSS v4.0 exploit maturity is rated "Proof of Concept" (Feedly).

1. Identify target: Locate a self-hosted esm.sh instance running a version prior to build v136 (Go pseudoversion before 0.0.0-20260116051925-c62ab83c589e), accessible over the network.
2. Craft malicious tarball: Create a gzipped tar archive containing at least one file entry with an absolute or traversal path (e.g., Name: "/../../../etc/cron.d/malicious") alongside a normal package file (e.g., package/index.js) to avoid immediate rejection.
3. Publish or serve the package: Host the malicious tarball at a registry endpoint that the target esm.sh instance will fetch from, or manipulate an existing package source to serve the crafted tarball.
4. Trigger package installation: Request a module from the esm.sh instance that causes it to fetch and extract the malicious package tarball (e.g., via an HTTP request to https://target-esm.sh/malicious-package).
5. Achieve arbitrary file write: The extractPackageTarball function processes the tar entry, applies path.Clean (which does not strip the absolute path), and writes the file to the traversal destination on the server filesystem — potentially overwriting configuration files, cached packages, or cron jobs depending on process permissions (GitHub Advisory, Fix Commit).

• File System: Unexpected files written outside the esm.sh npm store directory (e.g., /tmp, home directory, or system directories like /etc/cron.d/); modified or newly created files with allowlisted extensions (.js, .ts, .css, .map, .svelte, .vue) in unexpected locations.
• Logs: Server-side errors or unexpected file creation events logged during package tarball extraction; access logs showing requests for unusual or newly registered package names that trigger tarball fetches.
• Process: Unexpected processes spawned by the esm.sh service account, particularly if cron or scheduled task files were overwritten; unusual outbound network connections from the esm.sh server process.
• Network: HTTP requests to the esm.sh instance for package names not previously seen, especially from external or untrusted sources, that correlate with subsequent anomalous file system activity (GitHub Advisory).

Upgrade esm.sh to Go pseudoversion 0.0.0-20260116051925-c62ab83c589e or later (build v136 and above), which replaces the flawed path.Clean-based path normalization with filepath-based path handling and proper path sanitization using utils.NormalizePathname (Fix Commit, GitHub Advisory). No configuration-based workaround is available; upgrading is the only remediation. After upgrading, review the filesystem for unexpected files written during the vulnerability window, particularly in /tmp, the service account's home directory, and any system directories writable by the esm.sh process.

The vulnerability was discovered by security researcher kelbyludwig during analysis of recent Go security advisories, who noted that the prior fix (GO-2025-4138) was incomplete. The researcher followed a responsible disclosure timeline, committing to not disclose publicly until January 14, 2026, unless a fix was made public first (GitHub Advisory). The issue was acknowledged and patched by the esm.sh maintainer (ije) promptly. Coverage appeared on security aggregators including Red Hat CVE tracking, INCIBE-CERT, and LinuxSecurity, reflecting standard community awareness for a CDN infrastructure vulnerability.