Executive brief
esbuild is a popular JavaScript bundler that includes a development server. On Windows systems, the development server incorrectly validates file paths, allowing an attacker to read arbitrary files on the system by crafting specially-formatted requests with backslash characters. An attacker with local access who can make requests to the development server can read sensitive system files or configuration data.
Technical details
The vulnerability is a path traversal (CWE-22) in the development server's file serving logic on Windows. The root cause is improper path normalization: the code uses Go's path.Clean() function, which is POSIX-aware and only normalizes forward slashes (/), but Windows filesystems also recognize backslashes (\) as directory separators. An attacker can craft HTTP requests containing sequences like ..\..\..\ to escape the configured servedir root directory and access arbitrary files. The vulnerability requires local network access to the development server (attack vector: local) and low privileges (the attacker must be able to send HTTP requests), but no user interaction. The impact is confidentiality loss through arbitrary file read. The vulnerability was introduced in version 0.27.3 and patched in version 0.28.1.
Affected products
- evanw esbuild 0.27.3
Timeline
- 2026-06-11: disclosed
- 2026-06-12: patched: Fixed in version 0.28.1