esm.sh is a no-build content delivery network (CDN) for web development. In 137 and earlier, a Local File Inclusion (LFI) vulnerability exists in the esbuild pl…

A Local File Inclusion (LFI) vulnerability exists in esm.sh, a no-build content delivery network for web development. The vulnerability affects version 137 and earlier in the esbuild plugin's handling of the browser field in package.json files. Attackers can exploit this by publishing malicious npm packages that cause the server to read and return arbitrary files from the host filesystem during the build process. This represents a significant supply chain risk as it allows unauthorized access to sensitive server files through crafted npm packages.