CVE-2025-59341 Details
Description
esm.sh is a nobuild content delivery network(CDN) for modern web development. In 136 and earlier, a Local File Inclusion (LFI) issue was identified in the esm.sh service URL handling. An attacker could craft a request that causes the server to read and return files from the host filesystem (or other unintended file sources).
A local file inclusion (LFI) vulnerability has been identified in esm.sh, a no-build content delivery network (CDN) for modern web development. This issue affects versions through 136. The vulnerability arises from the service's URL handling, allowing an attacker to craft a request that prompts the server to read and return files from the host filesystem or other unintended file sources. Such exploitation could lead to the disclosure of sensitive information, including configuration files, private keys, and environment files, potentially enabling further attacks.
It is recommended to validate and sanitize URL paths by removing any '..' sequences before processing file requests. More guidance on input validation can be found in the OWASP Input Validation Cheat Sheet.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 17, 2025CISA-ADP
Assessed Sep 17, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/esm-dev/esm.sh/blob/c62f191d32639314ff0525d1c3c0e19ea2b16143/server/router.go#L1168 | [email protected] | Source CodeVendor |
| https://github.com/esm-dev/esm.sh/security/advisories/GHSA-49pv-gwxp-532r | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-23 | Relative Path Traversal | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| esm.sh | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Sep 17, 2025 | New CVE Received | [email protected] |