CVE-2026-109595

Hugo versions v0.84.0 before v0.167.0 are vulnerable to a path traversal vulnerability. The issue resides in the ESBuild fallback resolver used by the js.Build , js.Batch , and css.Build functions. This allows malicious themes or modules to use relative imports or symlinks to read files outside t...

CVE-2026-109595 Hugo v0.84.0 before v0.167.0 Path Traversal via js.Build ESBuild Resolver

Hugo from v0.84.0 before v0.167.0 contains a path traversal vulnerability that allows malicious themes or modules to read files outside the project root via ESBuild's fallback resolver in js.Build, js.Batch, and css.Build. Attackers can ship relative imports or symlinks pointing outside the proje...

CVE-2026-109595

Hugo from v0.84.0 before v0.167.0 contains a path traversal vulnerability that allows malicious themes or modules to read files outside the project root via ESBuild's fallback resolver in js.Build, js.Batch, and css.Build. Attackers can ship relative imports or symlinks pointing outside the proje...

CVE-2026-109595

Hugo from v0.84.0 before v0.167.0 contains a path traversal vulnerability that allows malicious themes or modules to read files outside the project root via ESBuild's fallback resolver in js.Build, js.Batch, and css.Build. Attackers can ship relative imports or symlinks pointing outside the proje...

CVE-2026-109595 Hugo v0.84.0 before v0.167.0 Path Traversal via js.Build ESBuild Resolver

Hugo from v0.84.0 before v0.167.0 contains a path traversal vulnerability that allows malicious themes or modules to read files outside the project root via ESBuild's fallback resolver in js.Build, js.Batch, and css.Build. Attackers can ship relative imports or symlinks pointing outside the proje...

PT-2026-111014

Name of the Vulnerable Software and Affected Versions Hugo versions 0.84.0 through 0.166.0 Description A path traversal issue exists where malicious themes or modules can read files outside the project root. This occurs through the ESBuild fallback resolver used in js.Build, js.Batch, and...

CVE-2026-109595: Improper Limitation of a Pathname to a Restricted Directory

Hugo from v0.84.0 before v0.167.0 contains a path traversal vulnerability that allows malicious themes or modules to read files outside the project root via ESBuild's fallback resolver in js.Build, js.Batch, and css.Build. Attackers can ship relative imports or symlinks pointing outside the proje...

@angular-architects/build-angular (16.2.0-next.2), @angular-builders/custom-esbuild (>=17.1.0-beta.0, <=19.1.0) +169 more potentially affected by CVE-2026-102992 via piscina (>=4.0.0, <=4.9.3)

piscina NPM version =4.0.0, =17.1.0-beta.0, =16.0.0-beta.0, =18.2.6-RC-1, =16.0.0, =16.2.0-next.0, =18.0.0-next.3, =2.2.7-bb.6, =2.1.5, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.17-dev.40 and more Source cves: CVE-2026-102992 Source advisory: SNYK:JS-PISCINA-20417213...

ROOT-APP-NPM-GHSA-GV7W-RQVM-QJHR GHSA-gv7w-rqvm-qjhr in esbuild - Patched by Root

Root has patched GHSA-gv7w-rqvm-qjhr in the esbuild package for Root:npm. Multiple fixed versions available...

Malicious code in esbuild-plugin-global-externals (npm)

--- Credit: OpenSSF source...

Malicious code in esbuild-linux-arm32 (npm)

The package esbuild-linux-arm32 was found to contain malicious code. --- Credit: OpenSSF source...

PT-2026-82646

Root has patched GHSA-gv7w-rqvm-qjhr in the esbuild package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-GHSA-67MH-4WV8-2F99 GHSA-67mh-4wv8-2f99 in esbuild - Patched by Root

Root has patched GHSA-67mh-4wv8-2f99 in the esbuild package for Root:npm. Multiple fixed versions available...

GO-2026-4946 vulnerabilities

Vulnerabilities for packages: helm-set-status, cert-exporter, cosign, prometheus-pushgateway, terraform-provider-pagerduty, dask-gateway, redis-operator, atlantis, spqr, php-fpmexporter, pgtimetable, kubernetes-dashboard, wave, kuberlr, lazygit, kube-arangodb, esbuild, helm-mapkubeapis,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: tfsec, conjur-cli, helm-set-status, hubble-ui, cosign, terraform-provider-pagerduty, dask-gateway, conftest, ingress-nginx-controller, ferretdb, doppler-kubernetes-operator, k3s, flux-kustomize-controller, kyverno-policy-reporter-kyverno-plugin,...

SUSE CVE-2026-44594

esm.sh is a no-build content delivery network CDN for web development. In 137 and earlier, a Local File Inclusion LFI vulnerability exists in the esbuild plugin's handling of the browser field in package.json. An attacker can publish an npm package that causes the server to read and return...

CLEANSTART-2026-FL75778 Security fixes in esbuild 0.25.0-r0

Package esbuild version 0.25.0-r0 fixes 3 vulnerabilities: CVE-2026-25679, CVE-2026-27142, CVE-2026-27139...

PT-2026-55956

Root has patched GHSA-67mh-4wv8-2f99 in the @rootio/esbuild package for Root:npm. Multiple fixed versions available...

GHSA-999R-QQ7V-R334 aws-cdk-lib: OS Command Injection in NodejsFunction Bundling

Summary AWS CDK aws-cdk-lib is an open-source framework for defining cloud infrastructure in code and provisioning it through AWS CloudFormation. OS command injection in the NodejsFunction local bundling pipeline in aws-cdk-lib before 2.245.0 2.246.0 on Windows might allow a threat actor who...

11th-ui (0.0.0), 120fps (>=0.1.0, <=0.7.0) +29104 more potentially affected by unknown CVE via esbuild (>=0.17.0, <=0.28.0)

esbuild NPM version =0.17.0, =0.1.0, =0.3.0, =0.0.1, =1.0.0, =1.0.1, =0.0.1, =0.0.4, =0.0.1, =0.0.1, =1.0.0, =1.1.0 and more Source cves: unknown CVE Source advisory: SNYK:JS-ESBUILD-17750822...