Vulnerability Details CVE-2025-50180
esm.sh is a no-build content delivery network (CDN) for web development. In version 136, esm.sh is vulnerable to a full-response SSRF, allowing an attacker to retrieve information from internal websites through the vulnerability. Version 137 fixes the vulnerability.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.0
EPSS Ranking 12.6%
CVSS Severity
CVSS v3 Score 7.5
Products affected by CVE-2025-50180
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
cpe:2.3:a:esm:esm.sh:135_1
-
cpe:2.3:a:esm:esm.sh:135_2
-
cpe:2.3:a:esm:esm.sh:135_3
-
cpe:2.3:a:esm:esm.sh:135_4
-
cpe:2.3:a:esm:esm.sh:135_5
-
cpe:2.3:a:esm:esm.sh:135_6
-
cpe:2.3:a:esm:esm.sh:135_7
-
-
cpe:2.3:a:esm:esm.sh:136_1
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-