{"id":"CVE-2025-59341","aliases":["GHSA-49pv-gwxp-532r","GO-2025-3962"],"url":"https://o3.security/vulnerability/CVE-2025-59341","summary":"Local File Inclusion in esm.sh","details":"esm.sh is a nobuild content delivery network(CDN) for modern web development. In 136 and earlier, a Local File Inclusion (LFI) issue was identified in the esm.sh service URL handling. An attacker could craft a request that causes the server to read and return files from the host filesystem (or other unintended file sources).","published":"2025-09-17T17:55:25.827Z","modified":"2026-08-08T03:30:42.645655876Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/esm-dev/esm.sh","fixedVersion":null}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/esm-dev/esm.sh/blob/c62f191d32639314ff0525d1c3c0e19ea2b16143/server/router.go#L1168"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59341.json"},{"type":"ADVISORY","url":"https://github.com/esm-dev/esm.sh/security/advisories/GHSA-49pv-gwxp-532r"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-59341"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-08T03:30:42.645655876Z"}}