Local File Inclusion (LFI)

github.com/esm-dev/esm.sh is vulnerable to Local File Inclusion. The vulnerability is due to improper handling of the browser field in package.json by the esbuild plugin, which allows an attacker to publish a malicious npm package that causes the server to read and return arbitrary files from the...

GHSA-RG65-45M7-HQ57 esm.sh: Path Traversal via package.json browser field allows reading arbitrary server files

Summary A Local File Inclusion LFI vulnerability exists in the esbuild plugin's handling of the browser field in package.json. An attacker can publish an npm package that causes the server to read and return arbitrary files from the host filesystem during the build process. Details The vulnerable...

PT-2026-40543

Name of the Vulnerable Software and Affected Versions esm.sh versions 137 and earlier Description A Local File Inclusion LFI issue exists in the esbuild plugin's handling of the browser field within the package.json file. An attacker can publish a malicious npm package that leverages ../ sequence...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: helm-set-status, terraform-provider-aws-fips, cert-exporter, cosign, prometheus-pushgateway, terraform-provider-pagerduty, json-exporter, dask-gateway, redis-operator, grafana-beyla, dynamic-localpv-provisioner-fips, flux-operator, nsc-fips, atlantis,...

CLEANSTART-2026-KD93706 Security fixes for CVE-2026-25679, CVE-2026-27139, CVE-2026-27142 applied in versions: 0.25.0-r0

Multiple security vulnerabilities affect the esbuild package. These issues are resolved in later releases. See references for individual vulnerability details...

org.webjars.npm:cssnano (5.1.14), org.webjars.npm:cssnano-preset-default (5.2.13) +2 more potentially affected by CVE-2026-29074 via org.webjars.npm:svgo (2.8.0)

org.webjars.npm:svgo MAVEN version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:svgo and may be impacted: - org.webjars.npm:cssnano 5.1.14 - org.webjars.npm:cssnano-preset-default 5.2.13 - org.webjars.npm:esbuild-plugin-svg 0.1...

AWS VDP: Command Injection via Unsanitized Bundling Options in `aws-cdk-lib/aws-lambda-nodejs`

Asset: aws-cdk-lib npm package, source: https://github.com/aws/aws-cdk Severity: High CWE: CWE-78 Improper Neutralization of Special Elements used in an OS Command, 'OS Command Injection' --- Summary The NodejsFunction construct in aws-cdk-lib/aws-lambda-nodejs constructs a shell command string...

[SECURITY] Fedora 42 Update: golang-github-evanw-esbuild-0.24.2-4.fc42

This is a JavaScript bundler and minifier. It packages up JavaScript and TypeScript code for distribution on the web...

Fedora: Security Advisory (FEDORA-2025-4068748872)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2025-be54db24e3)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 42 : golang-github-evanw-esbuild (2025-be54db24e3)

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-be54db24e3 advisory. Rebuild for CVEs Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested f...

Fedora 43 : golang-github-evanw-esbuild (2025-4068748872)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-4068748872 advisory. Rebuild for CVEs Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested f...

Malware in esbuild-plugin-brotli

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in esbuild-plugin-brotli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3297dd1fa55908191d232d7ae6e086066d65d1676c5e1d50b624a84ba1083a11 The package esbuild-plugin-brotli was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-199159

Malicious code in esbuild-plugin-brotli npm...

MAL-2025-191087 Malicious code in esbuild-plugin-brotli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3297dd1fa55908191d232d7ae6e086066d65d1676c5e1d50b624a84ba1083a11 The package esbuild-plugin-brotli was found to contain malicious code. Source: ghsa-malware...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

Malware in esbuild-plugin-eta

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

EUVD-2025-198837

Malicious code in esbuild-plugin-eta npm...

Malicious code in esbuild-plugin-eta (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eee6c2c46a6a594f389aa85580f033eb39c879f80478d3cca6d746bd8f8afe21 The package esbuild-plugin-eta was found to contain malicious code. Source: ghsa-malware...