The vulnerability is a local file inclusion flaw in the esbuild plugin’s handling of the browser field defined in a package.json file. An attacker can create and publish a malicious npm package that, during the CDN’s build process, causes the server to read and return arbitrary files from the host filesystem. This flaw exposes confidential server data; the description indicates that authentication is not required, though this is inferred and not explicitly stated, and can undermine the confidentiality of the deployment environment.

The affected system is esm.sh, a no-build CDN for web development. All releases of the esbuild plugin version 137 and earlier are vulnerable.

The CVSS score of 7.5 classifies this as a high‑severity weakness. Exploitation requires the ability to publish a package to the npm registry that points to esm.sh, a capability that can be exercised by any external attacker. While the EPSS score is not available, the known public exploit path (via publishing a malicious package) indicates a realistic threat. The vulnerability is not currently listed in the CISA KEV catalog.