[0.81]Component Governance critical alert Upgrade esbuild from 0.23.1 to 0.25.0 to fix the vulnerability.

[HariniMalothu17]

Summary esbuild allows any websites to send any request to the development server and read the response due to default CORS settings.

Details esbuild sets Access-Control-Allow-Origin: * header to all requests, including the SSE connection, which allows any websites to send any request to the development server and read the response. Recommendation Upgrade esbuild from 0.23.1 to 0.25.0 to fix the vulnerability.