CVE-2025-50180
High · 7.5CVSS
7.5
EPSS
0.4%
Published
Feb 25, 2026
CISA due date
—
The record
esm.sh is a no-build content delivery network (CDN) for web development. In version 136, esm.sh is vulnerable to a full-response SSRF, allowing an attacker to retrieve information from internal websites through the vulnerability. Version 137 fixes the vulnerability.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | github.com/esm-dev/esm.sh | 0 | 0.0.0-20250616164159-0593516c4cfa |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260226T182644-150000.1.149.1 |
Related vulnerabilities
- GO-2026-4545 esm.sh is vulnerable to full-response SSRF in github.com/esm-dev/esm.sh Same vulnerability
- GO-2026-4332 esm.sh has a path traversal in extractPackageTarball enables file writes from malicious… Also affects github.com/esm-dev/esm.sh
- CVE-2026-27730 esm.sh is a no-build content delivery network (CDN) for web development. Also affects github.com/esm-dev/esm.sh
- CVE-2026-23644 esm.sh is a no-build content delivery network (CDN) for web development. Also affects github.com/esm-dev/esm.sh
- GO-2025-4138 esm.sh CDN service has arbitrary file write via tarslip in github.com/esm-dev/esm.sh Also affects github.com/esm-dev/esm.sh
- GO-2025-4139 esm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScript in… Also affects github.com/esm-dev/esm.sh
- CVE-2025-65026 esm.sh CDN service has JS Template Literal Injection in CSS-to-JavaScript Also affects github.com/esm-dev/esm.sh
- CVE-2025-65025 esm.sh CDN service has arbitrary file write via tarslip Also affects github.com/esm-dev/esm.sh