CVE-2026-102657

Name of the Vulnerable Software and Affected Versions esm.sh versions prior to 137 7

Description The web.NewHandler static file server in web/handler.go fails to verify that the result of joining the URL-decoded r.URL.Path with Config.AppDir remains within the configured application directory. An unauthenticated remote attacker can use URL-encoded dot segments, such as %2e%2e, to bypass the traversal redirect performed by Go's ServeMux. This allows the attacker to access and disclose files outside of Config.AppDir that are readable by the server process, even when Dev mode is disabled.

Recommendations Update esm.sh to version 137 7.