{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"136"}],"component":"github.com/esm-dev/esm.sh","cve_ids":["CVE-2025-59341"],"ecosystem":"Go","epss":0.01636,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-49pv-gwxp-532r","id":"tcs_01M5KEWACRSZ1KAX2EHMMTZDAY","modified_at":"2026-09-10T03:50:28.013579511Z","published_at":"2025-09-17T18:39:20Z","references":["https://osv.dev/vulnerability/GHSA-49pv-gwxp-532r","https://github.com/esm-dev/esm.sh/security/advisories/GHSA-49pv-gwxp-532r","https://nvd.nist.gov/vuln/detail/CVE-2025-59341","https://github.com/esm-dev/esm.sh/commit/492de92850dd4d350c8b299af541f87541e58a45","https://github.com/esm-dev/esm.sh","https://github.com/esm-dev/esm.sh/blob/c62f191d32639314ff0525d1c3c0e19ea2b16143/server/router.go#L1168","https://pkg.go.dev/vuln/GO-2025-3962"],"severity":{"label":"high"},"sources":[{"source":"osv","source_id":"GHSA-49pv-gwxp-532r","url":"https://osv.dev/vulnerability/GHSA-49pv-gwxp-532r"}],"summary":"esm.sh has File Inclusion issue"}