GHSA-67mh-4wv8-2f99 moderate
esbuild enables any website to send any requests to the development server and read the response
Affected range
SEMVER: introduced 0; fixed 0.25.0Fixed versions: 0.25.0
esbuild
An extremely fast JavaScript and CSS bundler and minifier.
npm latest 0.28.2 MIT
Evidence path
Version, exploitation, severity
RequestGuard keeps these facts separate. A KEV match refers to a CVE, while OSV supplies the package and version match.
1
Latest version
0.28.2
No matching published advisory returned
2
Known exploitation
No KEV match
Checked by exact CVE identifier
3
Highest advisory severity
Moderate
2 active advisories
Check an exact version
The registry confirms the version, then OSV checks advisories for that exact value.
Published records
Advisories
esbuild allows arbitrary file read when running the development server on Windows
Affected range
SEMVER: introduced 0.27.3; fixed 0.28.1Fixed versions: 0.28.1