A path traversal vulnerability in esm.sh versions prior to 136 allows unauthenticated attackers to write arbitrary files to the server, posing a significant risk of remote code execution.

This is a path traversal vulnerability (CWE-22) occurring during the extraction of NPM package tarballs. An unauthenticated attacker can supply a malicious package containing crafted file paths that escape the intended directory, allowing for unauthorized file writes.

The ability to write arbitrary files to the server environment presents a critical risk to system integrity and confidentiality. By overwriting sensitive configuration files or placing executable scripts in web-accessible directories, an attacker can achieve remote code execution, leading to full system compromise. The CVSS score of 8.2 reflects the high impact on system integrity and the ease of exploitation for unauthenticated remote attackers.

Immediate Action: Update the esm.sh service to version 136 or later immediately to incorporate the path sanitization logic required to prevent directory traversal.

Proactive Monitoring: Monitor server file system logs for unexpected file creation events or attempts to access directories outside of the designated package storage path.

Compensating Controls: Implement strict file system permissions and run the service within a containerized environment with a read-only root file system to limit the scope of potential file write operations.

Public Exploit Available: Unknown

Given the potential for complete system compromise via arbitrary file write, organizations utilizing esm.sh must prioritize this update. Verify that the patching process successfully restricts file extraction to the intended directory and ensure that any temporary files created during the process are subjected to rigorous security scanning. Immediate application of the provided fix is the only reliable method to eliminate this exposure.