Executive brief
esbuild is a JavaScript bundler that developers use to build web applications during development. Its development server is enabled with overly permissive CORS headers that allow any website to fetch bundled JavaScript files and source maps from a developer's local machine, potentially exposing proprietary source code to malicious websites the developer visits.
Technical details
esbuild's development server sets the Access-Control-Allow-Origin header to "*" on all responses, including Server-Sent Events (SSE) endpoints, violating proper CORS origin validation (CWE-346). An attacker can host a malicious webpage that, when visited by a developer running esbuild's serve feature, uses JavaScript fetch() to retrieve bundled code and source maps from the local development server (typically http://127.0.0.1:8000/). The attacker can discover file names by querying /index.html, directory listings, or monitoring the /esbuild SSE endpoint. The attack requires user interaction (visiting a malicious site) but no authentication or special privileges. Versions up to and including 0.24.2 are affected; the fix is available in version 0.25.0.
Affected products
- evanw esbuild <= 0.24.2
Timeline
- 2025-02-10: disclosed: Advisory GHSA-67mh-4wv8-2f99 published
- 2025-02-07: patched: Fix committed; patched in version 0.25.0