https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 21:28:12 +0000 https://vulnerability.circl.lu/vuln/ghsa-67mh-4wv8-2f99 <p><strong>Affected:</strong> npm: esbuild</p> <p>### Summary</p> <p>esbuild allows any websites to send any request to the development server and read the response due to default CORS settings.</p> <p>### Details</p> <p>esbuild sets `Access-Control-Allow-Origin: *` header to all requests, including the SSE connection, which allows any websites to send any request to the development server and read the response.</p> <p>https://github.com/evanw/esbuild/blob/df815ac27b84f8b34374c9182a93c94718f8a630/pkg/api/serve_other.go#L121 https://github.com/evanw/esbuild/blob/df815ac27b84f8b34374c9182a93c94718f8a630/pkg/api/serve_other.go#L363</p> <p>**Attack scenario**:</p> <p>1. The attacker serves a malicious web page (`http://malicious.example.com`). 1. The user accesses the malicious web page. 1. The attacker sends a `fetch(&#39;http://127.0.0.1:8000/main.js&#39;)` request by JS in that malicious web page. This request is normally blocked by same-origin policy, but that&#39;s not the case for the reasons above. 1. The attacker gets the content of `http://127.0.0.1:8000/main.js`.</p> <p>In this scenario, I assumed that the attacker knows the URL of the bundle output file name. But the attacker can also get that information by</p> <p>- Fetching `/index.html`: normally you have a script tag here - Fetching `/assets`: it&#39;s common to have a `assets` directory when you have JS files and CSS files in a different directory and the directory listing feature tells the attacker the list of files - Connecting `/esbuild` SSE endpoint: the SSE endpoint sends the URL path of the changed files when the file…</p> <p><strong>Affected:</strong> npm: esbuild</p> <p>### Summary</p> <p>esbuild allows any websites to send any request to the development server and read the response due to default CORS settings.</p> <p>### Details</p> <p>esbuild sets `Access-Control-Allow-Origin: *` header to all requests, including the SSE connection, which allows any websites to send any request to the development server and read the response.</p> <p>https://github.com/evanw/esbuild/blob/df815ac27b84f8b34374c9182a93c94718f8a630/pkg/api/serve_other.go#L121 https://github.com/evanw/esbuild/blob/df815ac27b84f8b34374c9182a93c94718f8a630/pkg/api/serve_other.go#L363</p> <p>**Attack scenario**:</p> <p>1. The attacker serves a malicious web page (`http://malicious.example.com`). 1. The user accesses the malicious web page. 1. The attacker sends a `fetch(&#39;http://127.0.0.1:8000/main.js&#39;)` request by JS in that malicious web page. This request is normally blocked by same-origin policy, but that&#39;s not the case for the reasons above. 1. The attacker gets the content of `http://127.0.0.1:8000/main.js`.</p> <p>In this scenario, I assumed that the attacker knows the URL of the bundle output file name. But the attacker can also get that information by</p> <p>- Fetching `/index.html`: normally you have a script tag here - Fetching `/assets`: it&#39;s common to have a `assets` directory when you have JS files and CSS files in a different directory and the directory listing feature tells the attacker the list of files - Connecting `/esbuild` SSE endpoint: the SSE endpoint sends the URL path of the changed files when the file…</p> https://vulnerability.circl.lu/vuln/ghsa-67mh-4wv8-2f99