esm.sh es vulnerable a un SSRF de respuesta completa

The SSRF vulnerability in esm.sh allows an attacker to craft malicious URLs that, when processed by the service, trigger requests to internal resources. This can expose sensitive data residing on internal servers, such as configuration files, database backups, or even internal web applications. The attacker essentially leverages esm.sh as a proxy to bypass internal network security controls. A successful exploit could lead to data breaches, unauthorized access to internal systems, and potentially even further compromise if internal systems have vulnerabilities. The ability to retrieve arbitrary content makes this a significant risk, particularly in environments with strict network segmentation.

Organizations heavily reliant on esm.sh for JavaScript module resolution, particularly those with sensitive internal resources accessible via HTTP, are at risk. Environments with less stringent network segmentation policies are also more vulnerable, as an attacker could potentially leverage the SSRF to reach deeper into the internal network.

• linux / server:

journalctl -u esm-sh -g 'SSRF' | grep -i 'local.site'

• generic web:

curl -I https://esm.sh/https://local.site/test.md | grep -i 'local.site'

1. 2026-02-25Disclosure

   disclosure

1. Reservado2025-06-13
2. Publicada2026-02-25
3. Modificada2026-02-28
4. EPSS actualizado2026-03-23

The primary mitigation for CVE-2025-50180 is to immediately upgrade to version 0.0.0-20250616164159-0593516c4cfa or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to block requests containing suspicious URL suffixes (e.g., .js, .ts, .md). Additionally, review and restrict network access policies to limit the ability of esm.sh to make outbound requests to internal resources. Monitor esm.sh logs for unusual outbound requests that could indicate exploitation attempts. After upgrading, confirm the fix by attempting to access an internal resource via a crafted URL and verifying that the request is blocked or denied.