CVE-2025-50180CWE-918

esm.sh is vulnerable to full-response SSRF

High · published February 25, 2026

CVSS v4.0
8.7
EPSS
0%
Percentile
37.0
In the wild
Unconfirmed
What it is

esm.sh is a no-build content delivery network (CDN) for web development. In version 136, esm.sh is vulnerable to a full-response SSRF, allowing an attacker to retrieve information from internal websites through the vulnerability. Version 137 fixes the vulnerability.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00437 · 37.0th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-02-25T15:32Z
EPSS history
Timeline
  • 25 FEB 15:32Z
    esm.sh is vulnerable to full-response SSRF
    cvelistv5