esm.sh hat ein File Inclusion Problem in github.com/esm-dev/esm.sh

The File Inclusion vulnerability in esm.sh allows an attacker to control which files are included during the module loading process. By providing a malicious file path, an attacker could inject and execute arbitrary code within the context of the esm.sh environment. This could lead to a complete compromise of the system, including data exfiltration, denial of service, and further exploitation. The potential impact is significant, particularly in environments where esm.sh is used to load critical dependencies.

Applications and services that rely on esm.sh to load JavaScript modules are at risk. This includes projects using modern JavaScript build tools and frameworks. Developers who have integrated esm.sh into their workflows should prioritize upgrading to the patched version.

• go / server:

find /path/to/esm.sh -type f -name '*.go' -print0 | xargs -0 grep -i 'include' -A 5

• generic web:

curl -I https://your-esm-sh-instance/path/to/vulnerable/file?file=../../../../etc/passwd

1. 2025-09-24Disclosure

   disclosure

1. Reserviert2025-09-12
2. Veröffentlicht2025-09-24
3. Geändert2026-03-03
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-59341 is to immediately upgrade to version 136.0.1 or later of esm.sh. If upgrading is not immediately feasible, consider implementing strict input validation and sanitization on any user-controlled data used in file paths within esm.sh configurations. Review and restrict access to sensitive files that could be targeted by this vulnerability. Monitor system logs for unusual file access patterns that might indicate exploitation attempts.