CVE-2026-27730

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27730", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-23T18:37:14.789Z", "datePublished": "2026-02-25T15:37:01.753Z", "dateUpdated": "2026-02-25T20:32:05.079Z"}, "containers": {"cna": {"title": "esm.sh has SSRF localhost/private-network bypass in `/http(s)` module route", "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "lang": "en", "description": "CWE-918: Server-Side Request Forgery (SSRF)", "type": "CWE"}]}], "metrics": [{"cvssV3_0": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "version": "3.0"}}], "references": [{"name": "https://github.com/esm-dev/esm.sh/security/advisories/GHSA-p2v6-84h2-5x4r", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/esm-dev/esm.sh/security/advisories/GHSA-p2v6-84h2-5x4r"}], "affected": [{"vendor": "esm-dev", "product": "esm.sh", "versions": [{"version": "<= 137", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-25T15:37:01.753Z"}, "descriptions": [{"lang": "en", "value": "esm.sh is a no-build content delivery network (CDN) for web development. Versions up to and including 137 have an SSRF vulnerability (CWE-918) in esm.sh\u2019s `/http(s)` fetch route. The service tries to block localhost/internal targets, but the validation is based on hostname string checks and can be bypassed using DNS alias domains. This allows an external requester to make the esm.sh server fetch internal localhost services. As of time of publication, no known patched versions exist."}], "source": {"advisory": "GHSA-p2v6-84h2-5x4r", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-25T20:31:47.872081Z", "id": "CVE-2026-27730", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T20:32:05.079Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27730", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-25T20:31:47.872081Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T20:31:58.500Z"}}], "cna": {"title": "esm.sh has SSRF localhost/private-network bypass in `/http(s)` module route", "source": {"advisory": "GHSA-p2v6-84h2-5x4r", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_0": {"scope": "CHANGED", "version": "3.0", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "esm-dev", "product": "esm.sh", "versions": [{"status": "affected", "version": "<= 137"}]}], "references": [{"url": "https://github.com/esm-dev/esm.sh/security/advisories/GHSA-p2v6-84h2-5x4r", "name": "https://github.com/esm-dev/esm.sh/security/advisories/GHSA-p2v6-84h2-5x4r", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "esm.sh is a no-build content delivery network (CDN) for web development. Versions up to and including 137 have an SSRF vulnerability (CWE-918) in esm.sh\u2019s `/http(s)` fetch route. The service tries to block localhost/internal targets, but the validation is based on hostname string checks and can be bypassed using DNS alias domains. This allows an external requester to make the esm.sh server fetch internal localhost services. As of time of publication, no known patched versions exist."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918: Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-25T15:37:01.753Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27730", "state": "PUBLISHED", "dateUpdated": "2026-02-25T20:32:05.079Z", "dateReserved": "2026-02-23T18:37:14.789Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-25T15:37:01.753Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "esm.sh", "vendor": "esm-dev", "versions": [{"status": "affected", "version": "<= 137"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:esm:esm.sh:*:*:*:*:*:*:*:*", "matchCriteriaId": "AD6FA8D1-421D-416D-98EE-9DD8B7C02AAB", "versionEndIncluding": "137", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "esm.sh is a no-build content delivery network (CDN) for web development. Versions up to and including 137 have an SSRF vulnerability (CWE-918) in esm.sh\u2019s `/http(s)` fetch route. The service tries to block localhost/internal targets, but the validation is based on hostname string checks and can be bypassed using DNS alias domains. This allows an external requester to make the esm.sh server fetch internal localhost services. As of time of publication, no known patched versions exist."}, {"lang": "es", "value": "esm.sh es una red de entrega de contenido (CDN) sin compilaci\u00f3n para desarrollo web. Las versiones hasta la 137 inclusive tienen una vulnerabilidad SSRF (CWE-918) en la ruta de obtenci\u00f3n '/http(s)' de esm.sh. El servicio intenta bloquear objetivos localhost/internos, pero la validaci\u00f3n se basa en comprobaciones de cadenas de nombres de host y puede ser eludida usando dominios alias de DNS. Esto permite que un solicitante externo haga que el servidor de esm.sh obtenga servicios internos de localhost. Hasta el momento de la publicaci\u00f3n, no existen versiones parcheadas conocidas."}], "id": "CVE-2026-27730", "lastModified": "2026-06-17T10:27:34.187", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27730", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-25T20:31:47.872081Z", "version": "2.0.3"}}]}, "published": "2026-02-25T16:23:27.123", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/esm-dev/esm.sh/security/advisories/GHSA-p2v6-84h2-5x4r"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,137]"}}], "enrichment": {"confidence": 96.0, "confidence_source": "matching", "scores": [{"score": 96.0, "source": "matching"}]}, "original": {"product": "esm.sh", "source": "cna", "vendor": "esm-dev"}, "product": "esmsh", "vendor": "esm-dev"}], "analysis": {"en": {"generated_at": "2026-04-18T10:41:25.920632+00:00", "value": {"mitigation_remediation": ["Block outbound traffic from your esm.sh instance to internal IP ranges (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) using firewall rules.", "Disable or restrict the /http(s) fetch endpoint if a direct package fetch from your origin servers is possible.", "Monitor requests to the /http(s) endpoint for unusual or internal hostname patterns and investigate anomalous traffic."], "summary": {"action": "Assess Impact", "impact": "Internal Network Access"}, "threat_synthesis": {"affected_systems": "The vulnerable product is esm.sh, maintained by esm-dev, with releases up to and including version 137 affected. No newer versions were available at the time of publication.", "description_and_impact": "esm.sh is a CDN that fetches JavaScript packages via a public /http(s) route. A flaw (CWE\u2011918) in that endpoint allows an attacker to bypass the check that blocks localhost and internal targets by using DNS alias domains, turning the service into an SSRF tool capable of requesting internal localhost services. This can expose data or services that should remain private to an external attacker, and as of the time of publication no patched versions are available.", "risk_and_exploitability": "The CVSS base score of 7.5 indicates high severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not yet listed in the CISA KEV catalog. An external attacker can trigger the SSRF by sending HTTP requests to the /http(s) endpoint with crafted URLs, demonstrating a remote network attack vector and relying on the CDN\u2019s ability to resolve arbitrary DNS queries."}}}}, "created": "2026-02-26T13:15:49.588004+00:00", "updated": "2026-04-18T10:45:43.667790+00:00", "vendors": ["esm-dev", "esm-dev$PRODUCT$esmsh"]}