CVE-2025-59341: esm.sh has File Inclusion issue
(updated )
A Local File Inclusion (LFI) issue was identified in the esm.sh service URL handling. An attacker could craft a request that causes the server to read and return files from the host filesystem (or other unintended file sources).
Severity: High — LFI can expose secrets, configuration files, credentials, or enable further compromise. Impact: reading configuration files, private keys, environment files, or other sensitive files; disclosure of secrets or credentials; information leakage that could enable further attacks.
References
- github.com/advisories/GHSA-49pv-gwxp-532r
- github.com/esm-dev/esm.sh/blob/c62f191d32639314ff0525d1c3c0e19ea2b16143/server/router.go
- github.com/esm-dev/esm.sh/commit/492de92850dd4d350c8b299af541f87541e58a45
- github.com/esm-dev/esm.sh/security/advisories/GHSA-49pv-gwxp-532r
- nvd.nist.gov/vuln/detail/CVE-2025-59341
- pkg.go.dev/vuln/GO-2025-3962
Code Behaviors & Features
Detect and mitigate CVE-2025-59341 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →