AIKIDO-2026-445064
esbuild is vulnerable to Code Injection
81
High Risk
This Affects:
esbuildTL;DR
The esbuild Deno module downloads native platform binaries from an npm registry URL derived from NPM_CONFIG_REGISTRY and executes them without verifying SHA-256 integrity. An attacker who can influence that environment variable can redirect the download to a malicious binary that is written with executable permissions and spawned by Deno. Version 0.28.1 adds the same hash verification used by the Node.js install path before executing downloaded binaries.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and consuming esbuild through its Deno API in an environment where the NPM_CONFIG_REGISTRY variable can be attacker-influenced.
Background info
esbuild is vulnerable to Code Injection in versions 0.17.0 - 0.28.0.
How to fix this
Upgrade the esbuild library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant