CVE-2026-102657 Details
Description
esm.sh is a no-build content delivery network (CDN) for web development. Prior to server version 137_7, the documented web.NewHandler static file server in web/handler.go joins the URL-decoded r.URL.Path with Config.AppDir without verifying that the result remains inside the configured application directory. URL-encoded dot segments such as %2e%2e bypass the plain traversal redirect performed by Go's ServeMux, allowing an unauthenticated remote attacker to make the server open and return files outside Config.AppDir that are readable by the server process. The confirmed impact is file disclosure only, and the issue is reachable with Dev disabled. This issue is fixed in server version 137_7.
A path traversal vulnerability has been identified in esm.sh's static file server implementation within the web.NewHandler function, prior to server version 137_7. The vulnerability allows unauthenticated remote attackers to read files outside the designated application directory, Config.AppDir. This is achieved by exploiting URL-encoded dot segments, such as %2e%2e, which bypass the default traversal protections of Go's ServeMux. The issue is accessible with the Dev feature turned off.
Users are advised to update to esm.sh server version 137_7 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/esm-dev/esm.sh/commit/468b6b2a4b4dfec334cf6b33b01fcd4e5cd93bed | [email protected] | Source CodeVendor |
| https://github.com/esm-dev/esm.sh/commit/fc3b345e73aeaa0b7a05b6f27d91c05fdf5f9b53 | [email protected] | Source CodeVendor |
| https://github.com/esm-dev/esm.sh/pull/1376 | [email protected] | Issue TrackingVendor |
| https://github.com/esm-dev/esm.sh/releases/tag/v137_7 | [email protected] | Release NotesVendor |
| https://github.com/esm-dev/esm.sh/security/advisories/GHSA-g3c2-rjq2-c763 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| esm.sh | v0.1.0 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | New CVE Received | [email protected] |