Product

Esm.sh/Web (< 0.2.0)

1 brief RSS

esm.sh: web.NewHandler arbitrary file read via encoded dot-segment path traversal (CVE-2026-102657)

An unauthenticated path traversal vulnerability in esm.sh/web allows remote attackers to read arbitrary files by sending requests with URL-encoded dot-segments.

esm.sh/web path-traversal cve-2026-102657 arbitrary-file-read

1r 2t 1c 1h ago