esm.sh <= v136 - Local File Inclusion
CVE-2025-59341
Verified
Description
esm.sh <= 136 contains a local file inclusion caused by improper URL handling, letting attackers read arbitrary files from the host filesystem remotely, exploit requires crafted request.
Severity
High
CVSS Score
7.5
Exploit Probability
2%
Affected Product
esm.sh
Published Date
April 16, 2026
Template Author
0x_akoko
CVE-2025-59341.yaml
7.5Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVE ID:
cve-2025-59341
CWE ID:
cwe-23
Remediation Steps
Update esm.sh to a version later than 136 or the latest available version.