Read the docs
TI-2026-86122 Aliases CVE-2026-102657

Path traversal in esm.sh web.NewHandler allows arbitrary file read

Priority LOW 34CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-22 and the CVSS impact.

Summary

esm.sh server versions before 137_7 are affected. The web.NewHandler static file server joins the URL-decoded request path to the application directory without checking that the result stays inside it (CWE-22). Encoded dot segments bypass the plain traversal redirect of Go's ServeMux, so an unauthenticated remote attacker can make the server read and return files outside the application directory that the server process can read.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

esm.sh is a no-build content delivery network (CDN) for web development. Prior to server version 137_7, the documented web.NewHandler static file server in web/handler.go joins the URL-decoded r.URL.Path with Config.AppDir without verifying that the result remains inside the configured application directory. URL-encoded dot segments such as %2e%2e bypass the plain traversal redirect performed by Go's ServeMux, allowing an unauthenticated remote attacker to make the server open and return files outside Config.AppDir that are readable by the server process. The confirmed impact is file disclosure only, and the issue is reachable with Dev disabled. This issue is fixed in server version 137_7.

Why it matters now

EPSS 0.00716 54th percentileScored 2026-11-07
Fix Fixed esm.sh (esm-dev): 137_7

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
esm-devesm.shbefore 137_7137_7Patch availableCNA
  • esm.sh Vendoresm-dev Affected before 137_7 Fixed in 137_7 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:esm:esm.sh:*:*:*:*:*:*:*:*——esm-dev
  • cpe:2.3:a:esm:esm.sh:*:*:*:*:*:*:*:* Versions — — ·esm-dev

Remediation

Update esm.sh to server version 137_7, which fixes the issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA esm.sh (esm-dev) Fixed in 137_7

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-102657
  2. 2026-11-08 Priority changed: MEDIUM → LOW

References

Other 5

  • TI-2025-40211 esm.sh CDN service has arbitrary file write via tarslip CVSS 3.1CRITICAL 9.8
  • TI-2026-32504 esm.sh: Legacy Route Path Traversal Can Lead to RCE CVSS 4.0HIGH 8.7
  • TI-2025-32063 esm.sh is vulnerable to full-response SSRF CVSS 4.0HIGH 8.7
  • TI-2025-40212 esm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScript CVSS 3.1CRITICAL 9.6
  • TI-2025-36902 Local File Inclusion in esm.sh CVSS 4.0HIGH 7.7
  • TI-2026-32505 esm.sh: Path Traversal via package.json browser field allows reading arbitrary server files CVSS 3.1HIGH 7.5
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences