GHSA-FGQ5-Q76C-GX78 vulnerabilities

Vulnerabilities for packages: prometheus-operator, nats-server, ytt, esbuild, gcsfuse, terraform, yam, grype, govulncheck, paranoia, src-fingerprint, metrics-server, bom, dockerize, delve, eksctl, aws-load-balancer-controller, flux, rabbitmq-cluster-operator, supercronic, bazelisk, wireguard-go,...

GHSA-J6M3-GC37-6R6Q vulnerabilities

Vulnerabilities for packages: prometheus-operator, nats-server, ytt, esbuild, gcsfuse, terraform, yam, grype, govulncheck, paranoia, src-fingerprint, metrics-server, bom, dockerize, delve, eksctl, aws-load-balancer-controller, flux, rabbitmq-cluster-operator, supercronic, bazelisk, wireguard-go,...

1food-menu (>=0.0.1, <=0.3.8), 2473-alex-ui (>=0.0.1, <=0.0.4-alpha.3) +25064 more potentially affected by unknown CVE via esbuild (>=0.0.0, <=0.24.2)

esbuild NPM version =0.0.0, =0.0.1, =0.0.1, =1.0.0, =1.0.1, =0.1.0, =0.0.1, =0.0.4, =0.0.1, =1.0.0, =1.0.21, =1.0.23 and more Source cves: unknown CVE Source advisory: OSV:GHSA-67MH-4WV8-2F99...

esbuild enables any website to send any requests to the development server and read the response

Summary esbuild allows any websites to send any request to the development server and read the response due to default CORS settings. Details esbuild sets Access-Control-Allow-Origin: header to all requests, including the SSE connection, which allows any websites to send any request to the...

PT-2025-6214 · Esbuild · Esbuild

Name of the Vulnerable Software and Affected Versions: esbuild affected versions not specified Description: The issue allows any website to send requests to the development server and read the response due to default CORS settings. This is because esbuild sets the Access-Control-Allow-Origin:...

Malicious code in esbuild-plugin-global-externals (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-9597 Malicious code in esbuild-plugin-global-externals (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2023-45289 vulnerabilities

Vulnerabilities for packages: prometheus-operator, nats-server, ytt, esbuild, gcsfuse, terraform, yam, grype, govulncheck, paranoia, src-fingerprint, metrics-server, bom, dockerize, delve, eksctl, aws-load-balancer-controller, flux, rabbitmq-cluster-operator, supercronic, bazelisk, wireguard-go,...

CVE-2024-24784 vulnerabilities

Vulnerabilities for packages: prometheus-operator, nats-server, ytt, esbuild, gcsfuse, terraform, yam, grype, govulncheck, paranoia, src-fingerprint, metrics-server, bom, dockerize, delve, eksctl, aws-load-balancer-controller, flux, rabbitmq-cluster-operator, supercronic, bazelisk, wireguard-go,...

@keystone-6/core's NODE_ENV defaults to development with esbuild

Impact @keystone-6/[email protected] || 3.0.1 users that use NODEENV in their own code not dependencies to trigger security-sensitive functionality in a production build are vulnerable to NODEENV being inlined to "development" for user code. If your dependencies use NODEENV to trigger particular...

GHSA-25MX-2MXM-6343 @keystone-6/core's NODE_ENV defaults to development with esbuild

Impact @keystone-6/[email protected] || 3.0.1 users that use NODEENV in their own code not dependencies to trigger security-sensitive functionality in a production build are vulnerable to NODEENV being inlined to "development" for user code. If your dependencies use NODEENV to trigger particular...

CVE-2022-39382 NODE_ENV in Keystone defaults to development with esbuild

Keystone is a headless CMS for Node.js — built with GraphQL and React.@keystone-6/[email protected] || 3.0.1 users that use NODEENV to trigger security-sensitive functionality in their production builds are vulnerable to NODEENV being inlined to "development" for user code, irrespective of what your...

Fedora: Security Advisory for golang-github-evanw-esbuild (FEDORA-2022-ea8f4e232d)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 36 Update: golang-github-evanw-esbuild-0.14.38-3.fc36

This is a JavaScript bundler and minifier. It packages up JavaScript and TypeScript code for distribution on the web...

Fedora: Security Advisory for golang-github-evanw-esbuild (FEDORA-2022-3969b64d4b)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for golang-github-evanw-esbuild (FEDORA-2022-fae3ecee19)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 36 Update: golang-github-evanw-esbuild-0.14.38-2.fc36

This is a JavaScript bundler and minifier. It packages up JavaScript and TypeScript code for distribution on the web...

Improper Neutralization of Special Elements used in a Command ('Command Injection') in @floffah/build

Impact If you are using the esbuild target or command you are at risk of code/option injection. Attackers can use the command line option to maliciously change your settings in order to damage your project. Patches The problem has been patched in v1.0.0 as it uses a proper method to pass configs ...

PT-2021-24435

Name of the Vulnerable Software and Affected Versions: esbuild target or command versions prior to 1.0.0 Description: The issue allows attackers to maliciously change project settings through code or option injection, potentially damaging the project. This can be done by exploiting the command li...