Esbuild's XSS Bug that Survived 5 Billion Downloads and Bypassed HTML Sanitization
depthfirst.com | research | #supply-chain | #vulnerability-research | #xss | #javascript | #esbuild | #dev-server | #html-sanitization
Summary
How a low-severity XSS flag in esbuild's dev server became real: a folder name containing a double quote escaped the escapeForHTML function, enabling script execution; the fix was one line.
- Published
- Collected
--- id: 5443 title: "Esbuild's XSS Bug that Survived 5 Billion Downloads and Bypassed HTML Sanitization" source_domain: depthfirst.com source_url: "https://depthfirst.com/research/esbuilds-xss-bug-that-survived-5-billion-downloads-and-bypassed-html-sanitization" published_at: "2025-11-20T00:00:00Z" tags: ["supply-chain", "vulnerability-research", "xss", "javascript", "esbuild", "dev-server", "html-sanitization"] phying_url: "https://phying.com/item/5443" lang: en --- # Esbuild's XSS Bug that Survived 5 Billion Downloads and Bypassed HTML Sanitization ## Summary How a low-severity XSS flag in esbuild's dev server became real: a folder name containing a double quote escaped the escapeForHTML function, enabling script execution; the fix was one line. ## Intelligence Metadata - **Sources:** depthfirst.com - **Published:** 2025-11-20T00:00:00Z - **Original:** https://depthfirst.com/research/esbuilds-xss-bug-that-survived-5-billion-downloads-and-bypassed-html-sanitization - **Phying News:** https://phying.com/item/5443