Local File Inclusion in esm.sh
Priority HIGH 73CWE-23Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-23 and the CVSS impact.
Summary
esm.sh is a nobuild content delivery network(CDN) for modern web development. In 136 and earlier, a Local File Inclusion (LFI) issue was identified in the esm.sh service URL handling. An attacker could craft a request that causes the server to read and return files from the host filesystem (or other unintended file sources).
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01636 76th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| esm-dev | esm.sh | up to 136 | — | No fix listed | CNA |
| — | github.com/esm-dev/esm.sh (Go) | up to 136 | — | No fix listed | GHSA-49pv-gwxp-532r |
- esm.sh Vendoresm-dev Affected up to 136 Fixed in — No fix listed CNA
- github.com/esm-dev/esm.sh (Go) Vendor— Affected up to 136 Fixed in — No fix listed GHSA-49pv-gwxp-532r
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-59341
- 2026-10-03 Alias added: GHSA-49pv-gwxp-532r
References
Other 5
- https://github.com/esm-dev/esm.sh/security/advisories/GHSA-49pv-gwxp-532r
- https://github.com/esm-dev/esm.sh/blob/c62f191d32639314ff0525d1c3c0e19ea2b16143/server/router.go#L1168
- https://github.com/esm-dev/esm.sh/commit/492de92850dd4d350c8b299af541f87541e58a45
- https://github.com/esm-dev/esm.sh
- https://pkg.go.dev/vuln/GO-2025-3962
More esm-dev vulnerabilities
- TI-2025-40211 esm.sh CDN service has arbitrary file write via tarslip CVSS 3.1CRITICAL 9.8
- TI-2026-32504 esm.sh: Legacy Route Path Traversal Can Lead to RCE CVSS 4.0HIGH 8.7
- TI-2025-32063 esm.sh is vulnerable to full-response SSRF CVSS 4.0HIGH 8.7
- TI-2025-40212 esm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScript CVSS 3.1CRITICAL 9.6
- TI-2026-32505 esm.sh: Path Traversal via package.json browser field allows reading arbitrary server files CVSS 3.1HIGH 7.5
- TI-2026-22092 esm.sh has SSRF localhost/private-network bypass in `/http(s)` module route CVSS 3.1HIGH 7.5
Sources
- CVE-2025-59341 · CVE Program
- CVE-2025-59341 · NVD
- FIRST EPSS
- GHSA-49pv-gwxp-532r · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences