{"action":"Upgrade esbuild to 0.28.1 or later.","affected":[{"fixed":"0.28.1","introduced":"0.27.3"}],"component":"esbuild","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["0.28.1"],"ghsa_id":"GHSA-g7r4-m6w7-qqqr","id":"tcs_01M5KFQX4F92XJRCDPPNK30913","modified_at":"2026-09-10T03:50:49.427692265Z","published_at":"2026-06-12T20:08:53Z","references":["https://osv.dev/vulnerability/GHSA-g7r4-m6w7-qqqr","https://github.com/evanw/esbuild/security/advisories/GHSA-g7r4-m6w7-qqqr","https://github.com/evanw/esbuild","https://github.com/evanw/esbuild/releases/tag/v0.28.1"],"severity":{"label":"low","score":2.5},"sources":[{"source":"osv","source_id":"GHSA-g7r4-m6w7-qqqr","url":"https://osv.dev/vulnerability/GHSA-g7r4-m6w7-qqqr"}],"summary":"esbuild allows arbitrary file read when running the development server on Windows"}