In esm.sh versions 137 and earlier, the legacy router builds a storage key from the request path without sanitizing path components. When the key is used, the operating system resolves the relative segments and writes data to the target location, allowing an attacker to write data anywhere on the server. Based on the description, it is inferred that the arbitrary file write could lead to remote code execution if the attacker can embed malicious payloads in the written files.

The vulnerability affects the esm-dev:esm.sh CDN service for applications that use legacy routing in releases 137 and earlier. The affected code path resides in the legacyServer and buildStorage modules that compose the storage key directly from the HTTP request path.

The CVSS score of 8.7 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in the KEV catalog, but based on the description, the exposed HTTP interface makes remote exploitation likely. Attackers can trigger the flaw by sending a crafted request containing path traversal sequences, which the legacy router does not validate before writing to storage.