Executive brief
The esbuild Deno module, a tool used for bundling and minifying JavaScript code, fails to verify the integrity of the native binaries it downloads. An attacker who can influence the environment variables in a build system or CI/CD pipeline can force the tool to download and execute a malicious file. This could lead to a complete takeover of the build server or development environment, potentially allowing for the theft of source code or the injection of malware into software products.
Technical details
A vulnerability exists in the esbuild Deno module (lib/deno/mod.ts) due to the lack of binary integrity verification. While the Node.js implementation uses a SHA-256 hash check, the Deno implementation downloads native binaries from a URL constructed using the 'NPM_CONFIG_REGISTRY' environment variable and executes them without validation. An attacker who can control this environment variable—common in CI/CD pipelines or shared environments—can redirect the download to a malicious server. The downloaded binary is written to disk with executable permissions (0o755) and executed with the privileges of the Deno process. This issue is resolved in version 0.28.1.
Affected products
- evanw esbuild >= 0.17.0, < 0.28.1
Timeline
- 2026-06-11: disclosed
- 2026-06-11: patched: Fixed in version 0.28.1
- 2026-06-12: advisory