Is CVE-2026-102657 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-102657 being exploited in the wild.

How severe is CVE-2026-102657?

High severity, with a CVSS score of 7.5, published 6 November 2026.

Which products and versions are affected?

Esm.Sh before 137_7; github.com/esm-dev/esm.sh/web (Go) < 0.2.0, SEMVER:introduced=0,fixed=0.2.0.

Is there a fix for CVE-2026-102657?

Yes. github.com/esm-dev/esm.sh/web (Go): upgrade to 0.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-102657 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-102657?

Check whether you run Esm.Sh or github.com/esm-dev/esm.sh/web (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-102657: esm.sh path traversal in web.NewHandler file server

Q: Is there a fix for CVE-2026-102657?

Yes. github.com/esm-dev/esm.sh/web (Go): upgrade to 0.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-102657 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-102657?

Check whether you run Esm.Sh or github.com/esm-dev/esm.sh/web (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-102657 · Severity: high · CVSS 7.5 · Published 2026-11-06

esm.sh is a no-build CDN used by web developers to serve JavaScript modules without compilation. Prior to version 137_7, an attacker can bypass security checks using URL encoding to read arbitrary files readable by the server, such as configuration files, private keys, or source code. This allows unauthenticated remote access to sensitive files hosted on the server.

Vendors: Go.

Quick answers

Is CVE-2026-102657 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-102657 being exploited in the wild.
How severe is CVE-2026-102657?: High severity, with a CVSS score of 7.5, published 6 November 2026.
Which products and versions are affected?: Esm.Sh before 137_7; github.com/esm-dev/esm.sh/web (Go) < 0.2.0, SEMVER:introduced=0,fixed=0.2.0.
Is there a fix for CVE-2026-102657?: Yes. github.com/esm-dev/esm.sh/web (Go): upgrade to 0.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-102657 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-102657?: Check whether you run Esm.Sh or github.com/esm-dev/esm.sh/web (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/esm-dev/esm.sh/web (Go): upgrade to 0.2.0 or later
```
go get github.com/esm-dev/esm.sh/web@v0.2.0
```

Technical details

The vulnerability is a path traversal flaw in web/handler.go where URL-decoded paths are joined with Config.AppDir without validation. An attacker can use URL-encoded dot segments (%2e%2e) to bypass Go's ServeMux traversal checks and traverse outside the intended application directory. The fix validates the local path using filepath.IsLocal() and checks for null bytes before file access.

Affected products

esm.sh esm.sh before 137_7

Identifiers

CVE-2026-102657
GHSA-g3c2-rjq2-c763

Timeline

2026-11-06: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.