プラットフォーム
go
コンポーネント
github.com/esm-dev/esm.sh
修正版
136.0.1
136.0.1
CVE-2025-59341 describes a File Inclusion vulnerability discovered in esm.sh, a JavaScript module loader. This flaw allows attackers to potentially include arbitrary files, which could lead to code execution and compromise of the system. The vulnerability affects versions prior to 136.0.1, and a patch has been released to address the issue.
The File Inclusion vulnerability in esm.sh allows an attacker to manipulate the file inclusion process, potentially leading to the execution of malicious code. By crafting a malicious request, an attacker could include arbitrary files from the server, overwriting existing code or injecting new code. This could result in complete system compromise, including data theft, modification, and denial of service. The impact is particularly severe because esm.sh is used to load JavaScript modules, meaning a successful exploit could affect a wide range of applications and services that rely on it.
CVE-2025-59341 was publicly disclosed on 2025-09-24. The vulnerability's severity is rated HIGH (CVSS 7.5). No public proof-of-concept (PoC) code has been released as of this writing, but the nature of the File Inclusion vulnerability suggests that exploitation is likely possible. It is not currently listed on the CISA KEV catalog.
Applications and services that rely on esm.sh to load JavaScript modules are at risk. This includes projects using modern JavaScript build tools and frameworks. Developers who have integrated esm.sh into their workflows should prioritize upgrading to the patched version.
• go / server:
find /path/to/esm.sh -type f -name '*.go' -print0 | xargs -0 grep -i 'include' -A 5• generic web:
curl -I https://your-esm-sh-instance/path/to/vulnerable/file?file=../../../../etc/passwddisclosure
エクスプロイト状況
EPSS
0.11% (30% パーセンタイル)
CISA SSVC
The primary mitigation for CVE-2025-59341 is to upgrade to version 136.0.1 or later of esm.sh. If immediate upgrade is not possible, consider implementing input validation and sanitization on any user-supplied data used in file inclusion paths. Web application firewalls (WAFs) configured to detect and block attempts to include arbitrary files can also provide a temporary layer of protection. Monitor system logs for unusual file access patterns or attempts to include unexpected files.
Actualice a una versión posterior a la 136 de esm.sh. Esto solucionará la vulnerabilidad de inclusión de archivos locales. Consulte el advisory de seguridad en GitHub para obtener más detalles.
脆弱性分析と重要アラートをメールでお届けします。
CVE-2025-59341 is a File Inclusion vulnerability in esm.sh, allowing attackers to potentially include arbitrary files and execute malicious code. It is rated HIGH severity (CVSS 7.5).
You are affected if you are using esm.sh versions prior to 136.0.1. Assess your dependencies and upgrade immediately if vulnerable.
Upgrade to version 136.0.1 or later of esm.sh. If immediate upgrade is not possible, implement input validation and consider WAF rules.
No active exploitation has been confirmed as of this writing, but the vulnerability's nature suggests potential for exploitation.
Refer to the esm.sh project's repository and release notes for the official advisory and details on the fix.
go.mod ファイルをアップロードすると、影響の有無を即座にお知らせします。