PT-2025-6214 · Esbuild · Esbuild

Published 2025-02-10 · Updated 2025-02-10

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: esbuild (affected versions not specified)

Description: The issue allows any website to send requests to the development server and read the response due to default CORS settings. This is because esbuild sets the Access-Control-Allow-Origin: * header to all requests, including the SSE connection. An attacker can exploit this by serving a malicious web page, which sends a request to the development server, allowing them to access sensitive information such as compiled content or source maps if the source map option is enabled.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Origin Validation Error

Weakness Enumeration

CWE-346

Related Identifiers

GHSA-67MH-4WV8-2F99

Affected Products

Esbuild

References · 4

• https://osv.dev/vulnerability/GHSA-67mh-4wv8-2f99 · Vendor Advisory
• https://github.com/evanw/esbuild/commit/de85afd65edec9ebc44a11e245fd9e9a2e99760d · Note
• https://github.com/evanw/esbuild · Note
• https://github.com/evanw/esbuild/security/advisories/GHSA-67mh-4wv8-2f99 · Note