Advisories for Npm/Esbuild package

This advisory has been withdrawn.

The development server contains a path traversal vulnerability on Windows when serving files from servedir. Due to the use of path.Clean() (which only normalizes forward-slash / separators) instead of a Windows-aware path normalization function, it is possible to craft requests using backslashes () that bypass the intended directory containment logic. An attacker can escape the configured servedir root and access arbitrary files on the filesystem. This issue affects Windows environments …

esbuild allows any websites to send any request to the development server and read the response due to default CORS settings.