GHSA-67mh-4wv8-2f99: 
JavaScript vulnerability analysis and mitigation

The vulnerability (GHSA-67mh-4wv8-2f99) affects esbuild versions <=0.24.2 and was discovered in February 2025. This security issue allows any website to send requests to esbuild's development server and read the response due to permissive CORS (Cross-Origin Resource Sharing) settings. The vulnerability was patched in version 0.25.0 (GitHub Advisory).

The vulnerability stems from esbuild setting the 'Access-Control-Allow-Origin: *' header to all requests, including SSE (Server-Sent Events) connections. This configuration bypasses the same-origin policy, which normally prevents cross-origin requests. The vulnerability has been assigned a CVSS score of 5.3 (Moderate severity) with the following metrics: Network attack vector, High attack complexity, No privileges required, User interaction required, Unchanged scope, High confidentiality impact, and No impact on integrity or availability. The weakness is categorized as CWE-346 (GitHub Advisory).

The vulnerability enables malicious websites to access and steal source code from users utilizing esbuild's serve feature. Attackers can obtain both compiled content and, if source map option is enabled, non-compiled content. They can discover file locations through various methods including accessing index.html, assets directory, and the esbuild SSE endpoint (GitHub Advisory).

The attack can be executed by serving a malicious webpage that makes fetch requests to the local esbuild development server (typically at http://127.0.0.1:8000). The attacker can enumerate files by accessing index.html, the assets directory, and monitoring the SSE endpoint for file changes. The attack requires user interaction and has high complexity, but no special privileges are needed (GitHub Advisory).

The vulnerability has been patched in esbuild version 0.25.0. The fix disables CORS and denies requests if the host doesn't match the one provided to '--serve='. The default host is '0.0.0.0'. For customization needs, users can implement a proxy in front of esbuild to modify incoming and outgoing requests. The serve() API now returns an array of 'hosts' instead of a single 'host' string (GitHub Advisory).