{"id":"EM-20261109-FCR7","url":"https://cyber.eventmonitor.net/incident/EM-20261109-FCR7/esm-sh-vulnerability-cve-2026-102657/","type":"cve","title":"esm.sh Vulnerability (CVE-2026-102657)","subtitle":"CVE-2026-102657","subject":"CVE-2026-102657","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-11-09T22:03:29.000Z","firstSignal":"2026-11-06T21:17:05.863Z","lastSignal":"2026-11-09T22:03:29.000Z","updated":"2026-11-09T23:10:58.551Z","revision":2,"life":[{"status":"Born","at":"2026-11-09T22:03:29.000Z","why":"second independent source: C26 GitHub Advisory Database"},{"status":"Developing","at":"2026-11-09T22:03:29.000Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-06T21:17:05.863Z","what":"First signal: C6 NVD CVE API 2.0"},{"at":"2026-11-09T22:03:29.000Z","what":"Born: second source, C26 GitHub Advisory Database. Page EM-20261109-FCR7 created."},{"at":"2026-11-09T22:03:29.000Z","what":"Source joined: C29 CIRCL Vulnerability-Lookup"}],"stages":[{"name":"Disclosed","at":"2026-11-06T21:17:05.863Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-06T21:17:05.863Z","detail":"CVSS 7.5 · EPSS 0.7%"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-06T21:17:05.863Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":3,"title":"CVE-2026-102657 (CVSS 7.5)","text":"esm.sh is a no-build content delivery network (CDN) for web development. Prior to server version 137_7, the documented web.NewHandler static file server in web/handler.go joins the URL-decoded r.URL.Path with Config.AppDir without verifying that the result remains inside the configured application directory. URL-encoded dot segments such as %2e%2e bypass the plain traversal redirect performed by Go's ServeMux, allowing an unauthenticated remote attacker to make the server open and return files outside Config.AppDir that are readable by the server process. The confirmed impact is file…","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102657"},{"at":"2026-11-09T22:03:29.000Z","source":"C26","sourceName":"GitHub Advisory Database","role":"Database","severity":3,"title":"GHSA-g3c2-rjq2-c763 / CVE-2026-102657: esm.sh: web.NewHandler allows arbitrary file read via encoded dot-segment path traversal","text":"go:github.com/esm-dev/esm.sh/web","url":"https://github.com/advisories/GHSA-g3c2-rjq2-c763"},{"at":"2026-11-09T22:03:29.000Z","source":"C29","sourceName":"CIRCL Vulnerability-Lookup","role":"Database","severity":2,"title":"GHSA-g3c2-rjq2-c763 / CVE-2026-102657","text":"esm.sh: web.NewHandler allows arbitrary file read via encoded dot-segment path traversal","url":"https://vulnerability.circl.lu/vuln/GHSA-g3c2-rjq2-c763"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-06T21:17:05.863","score":7.5,"severity":"HIGH","desc":"esm.sh is a no-build content delivery network (CDN) for web development. Prior to server version 137_7, the documented web.NewHandler static file server in web/handler.go joins the URL-decoded r.URL.Path with Config.AppDir without verifying that the result remains inside the configured application…","product":"","seen":1794008532627},"kev":null,"epss":{"epss":0.00716,"pct":0.54053,"at":1794262241103},"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}