Description
esbuild allows any websites to send any request to the development server and read the response due to default CORS settings.
Recommendation
Update the esbuild package to the latest compatible version. Followings are version details:
- Affected version(s): <= 0.24.2
- Patched version(s): 0.25.0
References
Could your website be exposed too?
SmartScanner can check your website for esbuild enables any website to send any requests to the development server and read the response and gives you actionable findings to investigate.
Start a free scanRelated Issues
- esbuild allows arbitrary file read when running the development server on Windows - Vulnerability
- Opening a malicious website while running a Nuxt dev server could allow read-only access to code - CVE-2025-24361
- @saltcorn/server arbitrary file zip read and download when downloading auto backups - Vulnerability
- Opening a malicious website while running a Nuxt dev server could allow read-only access to code - @nuxt/webpack-builder - CVE-2025-24361
You might also like:
See something that needs correcting? Let us knowUpdated February 10, 2025