CVE-2025-59341 json
Local File Inclusion in esm.sh
published 2025-09-17 13 mo ago modified 2026-09-10 1 mo ago also EUVD-2025-29745 , GHSA-49pv-gwxp-532r , GO-2025-3962
- cvss
- 7.7
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.6%
- EPSS 1.6% chance of exploitation in 30 days, percentile 76%
- public exploits
- 0
- none known, plus a Nuclei check
Summary
esm.sh is a nobuild content delivery network(CDN) for modern web development. In 136 and earlier, a Local File Inclusion (LFI) issue was identified in the esm.sh service URL handling. An attacker could craft a request that causes the server to read and return files from the host filesystem (or other unintended file sources).
Patch / fix
- govulncheck-vulndb SLE Module for Package Hub 15 SP6, openSUSE Leap 15.6 0.0.20251023T162509-150000.1.110.1
suse advisories SUSE-SU-2025:3799-1
- govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
- govulncheck-vulndb openSUSE Tumbleweed 0.0.20250924T192141-1.1
opensuse advisories openSUSE-SU-2026:21483-1openSUSE-SU-2025:15576-1
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 13 mo ago
Exploit prediction
1.64% chance of exploitation in the next 30 days, higher than 76% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Nuclei template esm.sh <= v136 - Local File Inclusion nuclei detection template
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 7.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P |
| CNA | 4.0 | 7.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/esm-dev/esm.sh | <=136 all versions |
no fix listed |
Affected products
- esm-dev esm.sh
Classification
- Weakness
-
- CWE-23 Relative Path Traversal
References
-
github.com
/esm-dev/esm.sh/commit/492de92850dd4d350c8b299af541f87541e58a45
web, patch
-
github.com
/esm-dev/esm.sh/security/advisories/GHSA-49pv-gwxp-532r
web, advisory
-
github.com
/esm-dev/esm.sh/blob/c62f191d32639314ff0525d1c3c0e19ea2b16143/server/router.go#L1168
web
-
nvd.nist.gov
/vuln/detail/CVE-2025-59341
advisory
-
github.com
/esm-dev/esm.sh
package
-
pkg.go.dev
/vuln/GO-2025-3962
web
Sources
- CVE List CVE-2025-59341
- GitHub Advisory GHSA-49pv-gwxp-532r
- NVD CVE-2025-59341
- OSV GO-2025-3962
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.