Executive brief
A vulnerability in the esbuild development server on Windows allows unauthorized access to files on the host machine. esbuild is a popular tool used by developers to bundle and serve web application code during development. An attacker could exploit this to read sensitive system files or source code that should not be accessible through the web server, potentially leading to data exposure.
Technical details
A path traversal vulnerability exists in the esbuild development server's 'servedir' functionality on Windows. The root cause is the use of the POSIX-style 'path.Clean()' function to sanitize request paths; this function does not recognize backslashes ('\') as directory separators. An attacker can provide a path containing backslash-based traversal sequences (e.g., '..\..\') which bypass normalization but are later interpreted as valid separators by the Windows filesystem when the absolute path is joined. This allows for arbitrary file reads outside of the intended root directory. The issue is fixed in version 0.28.1.
Affected products
- evanw esbuild >= 0.27.3, < 0.28.1
Timeline
- 2026-06-11: disclosed
- 2026-06-12: advisory
- 2026-06-12: patched: Fixed in version 0.28.1