PT-2026-21933 · Esm Dev · Esm.Sh

Published 2026-02-25 · Updated 2026-03-03 · CVE-2025-50180

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions esm.sh versions prior to 137

Description esm.sh is susceptible to a full-response Server-Side Request Forgery (SSRF) issue. This allows an attacker to retrieve information from internal websites. The issue resides in the routing logic, specifically at the location https://github.com/esm-dev/esm.sh/blob/f80ff8c8d58749e77fa964abde468fc61f8bd89e/server/router.go#L511. An attacker can leverage this to access content from internal addresses with specific suffixes such as .js, .ts, .mjs, .mts, .jsx, .tsx, .cjs, .cts, .vue, .svelte, .md, and .css. A 302 redirect can be used to bypass the suffix restriction. Exploitation can lead to access of internal resources, and in cloud environments, potentially the retrieval of access keys (AK) and secret keys (SK) via the metadata service.

Recommendations Versions prior to 137 should be updated to version 137 or later. It is recommended to use safeurl.Client as a replacement for http.Client as described at https://github.com/esm-dev/esm.sh/blob/f80ff8c8d58749e77fa964abde468fc61f8bd89e/internal/fetch/fetch.go#L13.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-50180

GHSA-3C9R-837R-QQM4

GO-2026-4545

SUSE-SU-2026:0757-1

Affected Products

Esm.Sh

References · 122

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/50xxx/CVE-2025-50180.json · Exploit
• https://github.com/esm-dev/esm.sh/commit/0593516c4cfab49ad3b4900416a8432ff2e23eb0 · Patch
• https://github.com/esm-dev/esm.sh/pull/1149 · Patch
• https://github.com/esm-dev/esm.sh/security/advisories/GHSA-3c9r-837r-qqm4 · Vendor Advisory
• https://github.com/esm-dev/esm.sh/blob/f80ff8c8d58749e77fa964abde468fc61f8bd89e/server/router.go#L511 · Patch
• https://github.com/esm-dev/esm.sh/blob/f80ff8c8d58749e77fa964abde468fc61f8bd89e/internal/fetch/fetch.go#L13 · Patch
• https://osv.dev/vulnerability/GHSA-3c9r-837r-qqm4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-50180 · Security Note
• https://osv.dev/vulnerability/GO-2026-4545 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0757-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-50180 · Vendor Advisory
• https://github.com/esm-dev/esm.sh · Note
• https://github.com/esm-dev/esm.sh/releases/tag/v137 · Note
• https://suse.com/security/cve/CVE-2026-27112 · Note
• https://suse.com/security/cve/CVE-2026-21434 · Note