Skip to content
OpenAdvisories

Package · npm

esbuild

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Feed

  • Low 2.5
    GHSA-g7r4-m6w7-qqqr

    esbuild allows arbitrary file read when running the development server on Windows

    ### Summary The development server contains a path traversal vulnerability on Windows when serving files from `servedir`. Due to the use of `path.Clean()` (which only normalizes forward-slash `/` separators) instead of a Windows-aware path normalization funct…

    esbuild npm
  • Medium 5.3
    GHSA-67mh-4wv8-2f99

    esbuild enables any website to send any requests to the development server and read the response

    ### Summary esbuild allows any websites to send any request to the development server and read the response due to default CORS settings. ### Details esbuild sets `Access-Control-Allow-Origin: *` header to all requests, including the SSE connection, which all…

    esbuild npm