Is CVE-2026-44594 actively exploited?

No active exploitation of CVE-2026-44594 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-44594 be exploited remotely?

Yes. CVE-2026-44594 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-44594?

CVE-2026-44594 has a CVSS score of 7.5 (HIGH).

HOME VULNERABILITIESCVE-2026-44594

HIGH

CVE-2026-44594

CWE-22Published: May 28, 2026· Updated: May 29, 2026

7.5

CVSS v3.1

EPSS:0.04%probability of exploitation in 30 daysPercentile:13.7th

Official Description

esm.sh is a no-build content delivery network (CDN) for web development. In 137 and earlier, a Local File Inclusion (LFI) vulnerability exists in the esbuild plugin's handling of the browser field in package.json. An attacker can publish an npm package that causes the server to read and return arbitrary files from the host filesystem during the build process.

NVD Source

Technical Analysis

CVE-2026-44594 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), with a CVSS base score of 7.5.