Full-Response SSRF Vulnerability in esm.sh by esm-dev
CVE-2025-50180

8.7HIGH

Key Information:

Vendor

Esm-dev

Status
Esm.sh
Vendor
CVE Published:
25 February 2026

What is CVE-2025-50180?

The esm.sh platform, a no-build content delivery network, is susceptible to a full-response Server-Side Request Forgery (SSRF) in version 136. This vulnerability allows attackers to exploit the service to retrieve sensitive data from internal websites. The issue has been remediated in version 137, which fortifies the platform against such unauthorized access and enhances overall security for web developers relying on this CDN service.

Affected Version(s)

esm.sh = 136

References

https://github.com/esm-dev/esm.sh/security/advisories/GHS...
x_refsource_CONFIRM
https://github.com/esm-dev/esm.sh/pull/1149
x_refsource_MISC
https://github.com/esm-dev/esm.sh/commit/0593516c4cfab49a...
x_refsource_MISC

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.