Description
esm.sh 是一个用于 JavaScript 和 TypeScript 模块的 CDN 服务。该漏洞为路径遍历漏洞，攻击者可以通过构造恶意请求访问服务器上的任意文件，例如敏感配置文件或系统文件，可能导致敏感信息泄露。
esm.sh /pr/x/y@99 目录遍历漏洞（CVE-2025-59341）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-59341
https://github.com/esm-dev/esm.sh/security/advisories/GHSA-49pv-gwxp-532r
https://access.redhat.com/security/cve/cve-2025-59341
https://www.sentinelone.com/vulnerability-database/cve-2025-59341/
https://s4e.io/tools/esmsh-local-file-inclusion-cve-2025-59341
https://vulners.com/cve/CVE-2025-59341
https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMESMDEVESMSHSERVER-12927180
https://advisories.gitlab.com/golang/github.com/esm-dev/esm.sh/CVE-2025-59341/