AIKIDO-2026-725219
esbuild is vulnerable to Path Traversal
25
Low Risk
This Affects:
esbuildTL;DR
esbuild's local development server uses path.Clean() on HTTP request paths, which only normalizes forward slashes. On Windows, requests containing backslash separators can escape the configured servedir and read files outside the intended directory. Before 0.28.1, a crafted URL could reach arbitrary filesystem paths when the dev server runs on Windows. The fix rejects any request path containing a backslash character.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and running esbuild's local development server on Windows with a configured serve directory.
Background info
esbuild is vulnerable to Path Traversal in versions 0.17.0 - 0.28.0.
How to fix this
Upgrade the esbuild library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant