Description (CNA)
esm.sh is a nobuild content delivery network(CDN) for modern web development. In 136 and earlier, a Local File Inclusion (LFI) issue was identified in the esm.sh service URL handling. An attacker could craft a request that causes the server to read and return files from the host filesystem (or other unintended file sources).
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| esm-dev / esm.sh | affected <= 136 |
CWE
CWE-23
References
- https://github.com/esm-dev/esm.sh/security/advisories/GHSA-49pv-gwxp-532r
- https://github.com/esm-dev/esm.sh/blob/c62f191d32639314ff0525d1c3c0e19ea2b16143/server/router.go#L1168
ADP enrichment
No English description supplied.
No references supplied.