CVE-2025-59341: high-severity vulnerability in esm-dev esm.sh
Local File Inclusion in esm.sh
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
36Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendcvss 7.7epss 1.6%
esm.sh is a nobuild content delivery network(CDN) for modern web development. In 136 and earlier, a Local File Inclusion (LFI) issue was identified in the esm.sh service URL handling. An attacker could craft a request that causes the server to read and return files from the host filesystem (or other unintended file sources).
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P
Affected products
esm-dev · esm.shRelated CVEs — esm-dev esm.sh
In the same product, most dangerous first.
CVE-2025-59342MEDIUMesm.sh writes arbitrary files via path traversal in `X-Zone-Id` headerEPSS 3.2%CVE-2026-102657HIGHesm.sh: web.NewHandler allows arbitrary file read via encoded dot-segment path traversalEPSS 0.7%CVE-2025-65025HIGHesm.sh CDN service has arbitrary file write via tarslipEPSS 0.6%CVE-2026-23644HIGHesm.sh has path traversal in `extractPackageTarball` that enables file writes from malicious packagesEPSS 0.6%CVE-2025-65026MEDIUMesm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScriptEPSS 0.5%CVE-2026-44593HIGHesm.sh: Legacy Route Path Traversal Can Lead to RCEEPSS 0.4%