CVE-2026-27730

HighPublic PoC

Published: 25 February 2026

Published

25 February 2026

Modified

27 February 2026

KEV Added

—

Patch

—

CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Score 0.0006 19.8th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-27730 is a high-severity SSRF (CWE-918) vulnerability in Esm Esm.Sh. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 19.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190).

Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

CA-8 Penetration Testing

addresses: CWE-918

Penetration testing attempts server-side requests to internal resources, identifying SSRF weaknesses for remediation.

SC-7 Boundary Protection

addresses: CWE-918

Outbound connections to external resources can be monitored and limited at the boundary, reducing SSRF impact.

SI-10 Information Input Validation

addresses: CWE-918

Validates server-side URLs and resource references to block SSRF attempts.

SI-4 System Monitoring

addresses: CWE-918

Detects server-side request forgery through monitoring of unexpected outbound connections.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

SSRF in public esm.sh /http(s) fetch endpoint directly enables T1190 by allowing unauthenticated external attackers to exploit the Internet-facing application and reach internal localhost services.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

esm.sh is a no-build content delivery network (CDN) for web development. Versions up to and including 137 have an SSRF vulnerability (CWE-918) in esm.sh’s `/http(s)` fetch route. The service tries to block localhost/internal targets, but the validation is based on…

hostname string checks and can be bypassed using DNS alias domains. This allows an external requester to make the esm.sh server fetch internal localhost services. As of time of publication, no known patched versions exist.

Deeper analysisAI

CVE-2026-27730 is a Server-Side Request Forgery (SSRF) vulnerability (CWE-918) affecting esm.sh, a no-build content delivery network (CDN) used for web development. The issue resides in esm.sh's `/http(s)` fetch route and impacts versions up to and including 137. The service attempts to block requests to localhost and internal targets through hostname string validation, but this can be bypassed using DNS alias domains, enabling external attackers to force the esm.sh server to fetch internal localhost services. The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Any unauthenticated attacker with network access to esm.sh can exploit this vulnerability by crafting requests to the `/http(s)` fetch route that leverage DNS aliases to evade hostname checks. Successful exploitation allows the attacker to make the esm.sh server retrieve content from internal localhost services, potentially exposing sensitive internal data or resources without requiring privileges or user interaction.

The GitHub security advisory at https://github.com/esm-dev/esm.sh/security/advisories/GHSA-p2v6-84h2-5x4r details the vulnerability, and as of the CVE publication on 2026-02-25, no patched versions of esm.sh exist. Security practitioners should monitor for updates from the esm.sh maintainers and consider avoiding the affected `/http(s)` route or implementing client-side controls to restrict fetch targets until a fix is available.