Vulnerability details
CVE-2026-27730
esm-dev esm.sh
esm.sh has SSRF localhost/private-network bypass in `/http(s)` module route
CVSS 3.0
8.6High
Official description
esm.sh is a no-build content delivery network (CDN) for web development. Versions up to and including 137 have an SSRF vulnerability (CWE-918) in esm.sh’s `/http(s)` fetch route. The service tries to block localhost/internal targets, but the validation is based on hostname string checks and can be bypassed using DNS alias domains. This allows an external requester to make the esm.sh server fetch internal localhost services. As of time of publication, no known patched versions exist.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.6High | 3.0 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| esm-dev | esm.sh | <= 137 | CVEProject cvelistV5 (CNA) |
References and advisories
1- https://github.com/esm-dev/esm.sh/security/advisories/GHSA-p2v6-84h2-5x4r x_refsource_CONFIRM
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-02-25
- Last updated
- 2026-02-26
- State
- Published
- Assigner (CNA)
- GitHub_M
Exploit prediction (EPSS)
0.38%
Probability of exploitation in 30 days
32.8%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- Proof of concept
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-918Server-Side Request Forgery (SSRF)