CVE-2025-50180

Katalog CVE

CVSS 7.5 · High EPSS 0,39%

Kerentanan Server-Side Request Forgery (SSRF) pada esm.sh. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

esm.sh is a no-build content delivery network (CDN) for web development. In version 136, esm.sh is vulnerable to a full-response SSRF, allowing an attacker to retrieve information from internal websites through the vulnerability. Version 137 fixes the vulnerability.

Rincian

Terbit di NVD

25 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,39% peluang dieksploitasi; lebih tinggi dari 31,0% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/esm-dev/esm.sh/security/advisories/GHSA-3c9r-837r-qqm4 exploit · mitigasi · patch · advisory vendor
• https://github.com/esm-dev/esm.sh/blob/f80ff8c8d58749e77fa964abde468fc61f8bd89e/internal/fetch/fetch.go#L13 patch
• https://github.com/esm-dev/esm.sh/blob/f80ff8c8d58749e77fa964abde468fc61f8bd89e/server/router.go#L511 patch
• https://github.com/esm-dev/esm.sh/commit/0593516c4cfab49ad3b4900416a8432ff2e23eb0 patch
• https://github.com/esm-dev/esm.sh/pull/1149 issue tracking · patch
• https://github.com/esm-dev/esm.sh/releases/tag/v137 product · release notes