GHSA-g7r4-m6w7-qqqr

Summary

esbuild's development server (versions 0.27.3 up to but not including 0.28.1) allows arbitrary file read on Windows: a crafted request path can escape the served directory and read files elsewhere on disk. It affects the development server only, not production builds, but anyone running `esbuild --serve` on Windows is exposed to any local or networked attacker who can reach the server.

How to fix it

• Upgrade `esbuild` to 0.28.1 or later, which fixes the dev-server path handling.
• Until you upgrade, do not expose the esbuild dev server beyond localhost, and run it only behind a trusted network boundary.

How to avoid it in your code

• Never expose development servers to untrusted networks; bind them to localhost and put them behind a VPN or firewall if remote access is genuinely needed.
• Keep build tooling updated; dev-server file-serving bugs are common and only matter while the server is reachable.
• Treat the development server as untrusted infrastructure, kept separate from anything that holds secrets.

References

• https://github.com/evanw/esbuild/security/advisories/GHSA-g7r4-m6w7-qqqr
• https://github.com/evanw/esbuild/releases/tag/v0.28.1
• https://github.com/evanw/esbuild