What is the CVSS score of CVE-2025-50180?

CVE-2025-50180 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of Esm.Sh are affected by CVE-2025-50180?

Organizations using esm.sh version 136 face a critical Server-Side Request Forgery (SSRF) vulnerability that could allow attackers to access internal systems and sensitive data through the CDN…. A patch is available.

Is there a public PoC exploit available for CVE-2025-50180?

Yes, a public proof-of-concept exploit is available for CVE-2025-50180. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2025-50180?

Within 24 hours: Identify all systems and applications using esm.sh version 136 and assess exposure. Within 7 days: Upgrade esm.sh to the patched version and validate the update across all environments. Within 30 days: Conduct a security audit of any systems that may have been exposed during the vulnerability window and review access logs for suspicious activity.

Esm.Sh CVE-2025-50180

HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-02-25 security-advisories@github.com

GHSA-3c9r-837r-qqm4

SSRF Esm.Sh Suse

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

SUSE

HIGH

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Feb 27, 2026 - 17:44 vuln.today

Public exploit code

Patch released

Feb 27, 2026 - 17:44 nvd

Patch available

CVE Published

Feb 25, 2026 - 16:23 nvd

HIGH 7.5

DescriptionGitHub Advisory

esm.sh is a no-build content delivery network (CDN) for web development. In version 136, esm.sh is vulnerable to a full-response SSRF, allowing an attacker to retrieve information from internal websites through the vulnerability. Version 137 fixes the vulnerability.

AnalysisAI

Technical ContextAI

Classified as CWE-918 (Server-Side Request Forgery (SSRF)). Affects Esm.Sh. esm.sh is a no-build content delivery network (CDN) for web development. In version 136, esm.sh is vulnerable to a full-response SSRF, allowing an attacker to retrieve information from internal websites through the vulnerability. Version 137 fixes the vulnerability.

RemediationAI

A vendor patch is available — apply it immediately. Restrict network access to the affected service where possible.

Vendor StatusVendor

SUSE

Severity: High

Product	Status
openSUSE Leap 15.6	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP5	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP6	Fixed
openSUSE Leap 15.5	Fixed

CVE-2025-50180 vulnerability details – vuln.today

Back

Esm.Sh CVE-2025-50180

Severity by source

CVSS VectorGitHub Advisory

Lifecycle Timeline

DescriptionGitHub Advisory

AnalysisAI

Technical ContextAI

RemediationAI

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code