What is CVE-2025-59341?

CVE-2025-59341 is a vulnerability in Esm-Dev Esm.sh, classified under Relative Path Traversal. Published 2025-09-17.

Is CVE-2025-59341 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Path Traversal in Esm-Dev Esm.sh

CVE-2025-59341

esm.sh is a nobuild content delivery network(CDN) for modern web development. In 136 and earlier, a Local File Inclusion (LFI) issue was identified in the esm.sh service URL handling. An attacker could craft a request that causes the server to read and return files from the host filesystem (or other unintended file sources).

EPSS: 0.015 (72.1th percentile) — read the EPSS interpretation.

Affected products

Esm-dev Esm.sh — versions <= 136

Weakness classification (CWE)

CWE-23 — Relative Path Traversal

Public proof-of-concept exploits

fkie-cad/nvd-json-data-feeds

References

security-advisories@github.com (x_refsource_CONFIRM)
security-advisories@github.com (x_refsource_MISC)

Frequently asked questions

What is CVE-2025-59341?: CVE-2025-59341 is a vulnerability in Esm-Dev Esm.sh, classified under Relative Path Traversal. Published 2025-09-17.
Is CVE-2025-59341 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.