Go to packages list

esbuild

Ecosystem: npm

Downloads: 1.35 Bln

Vulnerabilities from the last (months)
  • 0CriticalAffects 0 versions
  • 1HighAffects 1 version
  • 0MediumAffects 0 versions
  • 1ModerateAffects 1 version
  • 1LowAffects 1 version
Severity distribution (all time)
3vulnerabilities
  • Critical0 (0.0%)
  • High1 (33.3%)
  • Medium0 (0.0%)
  • Moderate1 (33.3%)
  • Low1 (33.3%)

Monthly breakdown

  • Critical
  • High
  • Medium
  • Moderate
  • Low
  • 2 vulnerabilities
    • Critical: 0
    • High: 1
    • Medium: 0
    • Moderate: 0
    • Low: 1
  • 1 vulnerabilities
    • Critical: 0
    • High: 0
    • Medium: 0
    • Moderate: 1
    • Low: 0

Vulnerabilities (3)

Known vulnerabilities affecting esbuild, based on data from OSV.

Vulnerabilities affecting esbuild
IDSeveritySummaryAffected versionsPublishedSource
GHSA-g7r4-m6w7-qqqrLowesbuild allows arbitrary file read when running the development server on Windows### Summary The development server contains a path traversal vulnerability on Windows when serving files from `servedir`. Due to the use of `path.Clean()` (which only normalizes forward-slash `/` separators) instead of a Windows-aware path normalization function, it is possible to craft requests using backslashes (`\`) that bypass the intended directory containment logic. An attacker can escape the configured `servedir` root and access arbitrary files on the filesystem. This issue affects Windows environments only. ### Details The request path is sanitized using: ```go // https://github.co
  • >= 0.27.3, < 0.28.1
GitHub (opens in a new tab)
GHSA-gv7w-rqvm-qjhrHighWithdrawn Advisory: esbuild: Missing binary integrity verification in Deno module enables remote code execution via NPM_CONFIG_REGISTRY## Withdrawn Advisory This advisory has been withdrawn because the affected package was incorrectly identified and the [actual affected package](https://github.com/esbuild/deno-esbuild) is not in a supported ecosystem. This link is maintained to preserve external references. ## Original Description ### Summary The esbuild Deno module (`lib/deno/mod.ts`) downloads native binary executables from an npm registry and writes them to disk with executable permissions (`0o755`) **without performing any integrity verification** (e.g., SHA-256 hash check). The Node.js equivalent (`lib/npm/node-insta
  • >= 0.17.0, < 0.28.1
GitHub (opens in a new tab)
GHSA-67mh-4wv8-2f99Moderateesbuild enables any website to send any requests to the development server and read the response### Summary esbuild allows any websites to send any request to the development server and read the response due to default CORS settings. ### Details esbuild sets `Access-Control-Allow-Origin: *` header to all requests, including the SSE connection, which allows any websites to send any request to the development server and read the response. https://github.com/evanw/esbuild/blob/df815ac27b84f8b34374c9182a93c94718f8a630/pkg/api/serve_other.go#L121 https://github.com/evanw/esbuild/blob/df815ac27b84f8b34374c9182a93c94718f8a630/pkg/api/serve_other.go#L363 **Attack scenario**: 1. The attacke
  • < 0.25.0
GitHub (opens in a new tab)
  • GHSA-g7r4-m6w7-qqqrLow
    esbuild allows arbitrary file read when running the development server on Windows
    • >= 0.27.3, < 0.28.1
    GitHub (opens in a new tab)

    ### Summary The development server contains a path traversal vulnerability on Windows when serving files from `servedir`. Due to the use of `path.Clean()` (which only normalizes forward-slash `/` separators) instead of a Windows-aware path normalization function, it is possible to craft requests using backslashes (`\`) that bypass the intended directory containment logic. An attacker can escape the configured `servedir` root and access arbitrary files on the filesystem. This issue affects Windows environments only. ### Details The request path is sanitized using: ```go // https://github.co

  • GHSA-gv7w-rqvm-qjhrHigh
    Withdrawn Advisory: esbuild: Missing binary integrity verification in Deno module enables remote code execution via NPM_CONFIG_REGISTRY
    • >= 0.17.0, < 0.28.1
    GitHub (opens in a new tab)

    ## Withdrawn Advisory This advisory has been withdrawn because the affected package was incorrectly identified and the [actual affected package](https://github.com/esbuild/deno-esbuild) is not in a supported ecosystem. This link is maintained to preserve external references. ## Original Description ### Summary The esbuild Deno module (`lib/deno/mod.ts`) downloads native binary executables from an npm registry and writes them to disk with executable permissions (`0o755`) **without performing any integrity verification** (e.g., SHA-256 hash check). The Node.js equivalent (`lib/npm/node-insta

  • GHSA-67mh-4wv8-2f99Moderate
    esbuild enables any website to send any requests to the development server and read the response
    • < 0.25.0
    GitHub (opens in a new tab)

    ### Summary esbuild allows any websites to send any request to the development server and read the response due to default CORS settings. ### Details esbuild sets `Access-Control-Allow-Origin: *` header to all requests, including the SSE connection, which allows any websites to send any request to the development server and read the response. https://github.com/evanw/esbuild/blob/df815ac27b84f8b34374c9182a93c94718f8a630/pkg/api/serve_other.go#L121 https://github.com/evanw/esbuild/blob/df815ac27b84f8b34374c9182a93c94718f8a630/pkg/api/serve_other.go#L363 **Attack scenario**: 1. The attacke

Showing 1-3 of 3 vulnerabilities