Back to Database
Status published
High
CVE-2025-59341
Local File Inclusion in esm.sh
Vulnerability Description
esm.sh is a nobuild content delivery network(CDN) for modern web development. In 136 and earlier, a Local File Inclusion (LFI) issue was identified in the esm.sh service URL handling. An attacker could craft a request that causes the server to read and return files from the host filesystem (or other unintended file sources).
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-59341
Credits & Attribution
No credits recorded in the NVD database.
References
More from esm-dev
View All →CVE-2025-65026
esm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScript
Medium
6.1
CVE-2025-65025
esm.sh CDN service has arbitrary file write via tarslip
High
8.2
CVE-2025-59342
esm.sh writes arbitrary files via path traversal in `X-Zone-Id` header
Medium
5.5
CVE-2025-50180
esm.sh is vulnerable to full-response SSRF
High
8.7
Affected Vendor
esm-dev
View all reports →Affected Software
esm.sh
Vulnerable Versions:
<= 136
Timeline
Official Publish:
September 17th, 2025
Last Modified:
September 17th, 2025
Added to House:
July 22nd, 2026