esm-dev github.com/esm-dev/esm.sh/web vulnerabilities

Latest esm-dev github.com/esm-dev/esm.sh/web CVEs

Newest publication first

1. CVE-2026-102657 esm.sh: web.NewHandler allows arbitrary file read via encoded dot-segment path traversal

   Published 2026-11-06

   High·CVSS 7.5

   esm.sh is a no-build content delivery network (CDN) for web development. Prior to server version 137_7, the documented web.NewHandler static file server in web/handler.go joins the URL-decoded r.URL.Path with Config.AppDir without verifying that the result remains inside the conf...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.