Libraesva patches CVE-2025-59689 after confirmed state-sponsored exploitation; update ESG to avoid command injection.