high·Product Based Web Vulnerabilities·Updated Apr 21, 2026

esm.sh <= v136 - Local File Inclusion

Est. Time~10 seconds

Scan TypeGroup Scan

Targetsdomain, subdomain, ipv4

CostFree

Times Used

continuous scan runs

Continuously Checked

assets under CS

Vulnerabilities Found

confirmed findings

References

github.com↗

CVECVE-2025-59341

7.7

CVSShigh

Exploitable remotely over the internet · no authentication required.

Description

esm.sh is a nobuild content delivery network(CDN) for modern web development. In 136 and earlier, a Local File Inclusion (LFI) issue was identified in the esm.sh service URL handling. An attacker could craft a request that causes the server to read and return files from the host filesystem (or other unintended file sources).

Attack Vector

Network

Privileges Req.

None

User Interaction

None

Affected

esm.shby esm-dev

<= 136

Updated Nov 10, 2026View on NVD →

Similar Tools

Check your infrastructure.
Right now.

12,000+ scanners. Free to start. No credit card required.

esm.sh <= v136 - Local File Inclusion

Check your infrastructure.Right now.

Check your infrastructure.
Right now.