CVE-2026-102657

esm.sh is a no-build content delivery network (CDN) for web development. Prior to server version 137_7, the documented web.NewHandler static file server in web/handler.go joins the URL-decoded r.URL.Path with Config.AppDir without verifying that the result remains inside the configured application directory. URL-encoded dot segments such as %2e%2e bypass the plain traversal redirect performed by Go's ServeMux, allowing an unauthenticated remote attacker to make the server open and return files outside Config.AppDir that are readable by the server process. The confirmed impact is file disclosure only, and the issue is reachable with Dev disabled. This issue is fixed in server version 137_7.

• CWE-22

• https://github.com/esm-dev/esm.sh/commit/468b6b2a4b4dfec334cf6b33b01fcd4e5cd93bed
• https://github.com/esm-dev/esm.sh/commit/fc3b345e73aeaa0b7a05b6f27d91c05fdf5f9b53
• https://github.com/esm-dev/esm.sh/pull/1376
• https://github.com/esm-dev/esm.sh/releases/tag/v137_7
• https://github.com/esm-dev/esm.sh/security/advisories/GHSA-g3c2-rjq2-c763
• https://github.com/esm-dev/esm.sh/security/advisories/GHSA-g3c2-rjq2-c763

Published

Nov 6, 2026

Last Modified

Nov 11, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-102639MobilityDB version 1.3.0 and earlier contains an out-of-boun…6.5
• CVE-2026-10264A vulnerability was determined in lharries whatsapp-mcp 0.0.…3.5
• CVE-2026-102643AsyncSSH is a Python package which provides an asynchronous …8.8
• CVE-2026-102649Burrito is a Terraform Automation Collaboration Software (TA…9.9
• CVE-2026-10265A vulnerability was identified in itsourcecode Content Manag…6.3
• CVE-2026-102650Nuxt Content is the file-based CMS for Nuxt applications, po…7.5
• CVE-2026-102663OpenList is a file list program that supports multiple stora…4.3
• CVE-2026-102664ProxySQL is a proxy for MySQL and its forks, as well as Post…7.1
• CVE-2026-102666The Joyland AI app contains hard-coded credentials for the G…6.5
• CVE-2026-102667Joyland AI app allows an attacker with shared network access…8.3
• CVE-2026-102668The Joyland AI app accepts any TLS certificates from any ser…5.3
• CVE-2026-102669Joyland AI app does not verify hostnames, allowing a malicio…5.3