Directory Traversal

Overview esbuild is an An extremely fast JavaScript and CSS bundler and minifier. Affected versions of this package are vulnerable to Directory Traversal in the servedir process on Windows systems due to improper path normalization. An attacker can access arbitrary files outside the intended...

0xradishsdk (>=1.9.0, <=2.0.2), 2.typescript-init (1.0.0) +5890 more potentially affected by unknown CVE via esbuild (>=0.27.3, <=0.28.0)

esbuild NPM version =0.27.3, =1.9.0, =0.0.1, =0.1.1, =0.1.5, =0.1.0, =1.0.22, =0.1.0, =0.1.6, =0.2.9, =0.0.1, =13.7.0, =0.5.4, =0.0.2, =0.0.5 and more Source cves: unknown CVE Source advisory: OSV:GHSA-G7R4-M6W7-QQQR...

0xradishsdk (>=1.9.0, <=2.0.2), 2.typescript-init (1.0.0) +5890 more potentially affected by unknown CVE via esbuild (>=0.27.3, <=0.28.0)

esbuild NPM version =0.27.3, =1.9.0, =0.0.1, =0.1.1, =0.1.5, =0.1.0, =1.0.22, =0.1.0, =0.1.6, =0.2.9, =0.0.1, =13.7.0, =0.5.4, =0.0.2, =0.0.5 and more Source cves: unknown CVE Source advisory: SNYK:JS-ESBUILD-17750815...

NPM: esbuild allows arbitrary file read when running the development server on Windows

NPM: esbuild allows arbitrary file read when running the development server on Windows vulnerability discovered by ? in WordPress Npm esbuild versions = 0.27.3, 0.28.1...

esbuild allows arbitrary file read when running the development server on Windows

Summary The development server contains a path traversal vulnerability on Windows when serving files from servedir. Due to the use of path.Clean which only normalizes forward-slash / separators instead of a Windows-aware path normalization function, it is possible to craft requests using...

Command Injection

Overview aws-cdk-lib is a Version 2 of the AWS Cloud Development Kit library Affected versions of this package are vulnerable to Command Injection via the NodejsFunction local bundling pipeline, when an attacker controls the value of one or more of the properties externalModules, define, loader,...

PT-2026-48489

Name of the Vulnerable Software and Affected Versions aws-cdk-lib versions prior to 2.245.0 aws-cdk-lib versions prior to 2.246.0 Windows Description OS command injection exists in the NodejsFunction local bundling pipeline. An actor who controls the value of one or more bundling...

CVE-2026-44594

esm.sh is a no-build content delivery network CDN for web development. In 137 and earlier, a Local File Inclusion LFI vulnerability exists in the esbuild plugin's handling of the browser field in package.json. An attacker can publish an npm package that causes the server to read and return...

CVE-2026-44594

esm.sh is a no-build content delivery network CDN for web development. In 137 and earlier, a Local File Inclusion LFI vulnerability exists in the esbuild plugin's handling of the browser field in package.json. An attacker can publish an npm package that causes the server to read and return...

CVE-2026-44594

esm.sh is a no-build content delivery network CDN for web development. In 137 and earlier, a Local File Inclusion LFI vulnerability exists in the esbuild plugin's handling of the browser field in package.json. An attacker can publish an npm package that causes the server to read and return...

EUVD-2026-32911

esm.sh is a no-build content delivery network CDN for web development. In 137 and earlier, a Local File Inclusion LFI vulnerability exists in the esbuild plugin's handling of the browser field in package.json. An attacker can publish an npm package that causes the server to read and return...

CVE-2026-44594: Improper Limitation of a Pathname to a Restricted Directory

esm.sh is a no-build content delivery network CDN for web development. In 137 and earlier, a Local File Inclusion LFI vulnerability exists in the esbuild plugin's handling of the browser field in package.json. An attacker can publish an npm package that causes the server to read and return...

esm.sh 安全漏洞

esm.sh is an open-source content distribution network developed by esm.sh. Versions of esm.sh 137 and earlier contained a security vulnerability. This vulnerability stemmed from the esbuild plugin’s handling of the browser field in package.json, which allowed attackers to publish npm packages,...

Local File Inclusion (LFI)

github.com/esm-dev/esm.sh is vulnerable to Local File Inclusion. The vulnerability is due to improper handling of the browser field in package.json by the esbuild plugin, which allows an attacker to publish a malicious npm package that causes the server to read and return arbitrary files from the...

GHSA-RG65-45M7-HQ57 esm.sh: Path Traversal via package.json browser field allows reading arbitrary server files

Summary A Local File Inclusion LFI vulnerability exists in the esbuild plugin's handling of the browser field in package.json. An attacker can publish an npm package that causes the server to read and return arbitrary files from the host filesystem during the build process. Details The vulnerable...

PT-2026-40543

Name of the Vulnerable Software and Affected Versions esm.sh versions 137 and earlier Description A Local File Inclusion LFI issue exists in the esbuild plugin's handling of the browser field within the package.json file. An attacker can publish a malicious npm package that leverages ../ sequence...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: nri-nginx-fips, podman-fips, aws-load-balancer-controller, rancher-webhook-fips, cloudnative-pg-fips, witness, ytt, pgtimetable, telegraf, crossplane-provider-aws-ecs, nri-f5, kyverno, nuclei, backup-restore-operator-fips, cert-manager-csi-driver, commercial-grafana,...

CLEANSTART-2026-KD93706 Security fixes for CVE-2026-25679, CVE-2026-27139, CVE-2026-27142 applied in versions: 0.25.0-r0

Multiple security vulnerabilities affect the esbuild package. These issues are resolved in later releases. See references for individual vulnerability details...

org.webjars.npm:cssnano (5.1.14), org.webjars.npm:cssnano-preset-default (5.2.13) +2 more potentially affected by CVE-2026-29074 via org.webjars.npm:svgo (2.8.0)

org.webjars.npm:svgo MAVEN version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars.npm:svgo and may be impacted: - org.webjars.npm:cssnano 5.1.14 - org.webjars.npm:cssnano-preset-default 5.2.13 - org.webjars.npm:esbuild-plugin-svg 0.1...

AWS VDP: Command Injection via Unsanitized Bundling Options in `aws-cdk-lib/aws-lambda-nodejs`

Asset: aws-cdk-lib npm package, source: https://github.com/aws/aws-cdk Severity: High CWE: CWE-78 Improper Neutralization of Special Elements used in an OS Command, 'OS Command Injection' --- Summary The NodejsFunction construct in aws-cdk-lib/aws-lambda-nodejs constructs a shell command string...