---
id: 5443
title: "Esbuild's XSS Bug that Survived 5 Billion Downloads and Bypassed HTML Sanitization"
source_domain: depthfirst.com
source_url: "https://depthfirst.com/research/esbuilds-xss-bug-that-survived-5-billion-downloads-and-bypassed-html-sanitization"
published_at: "2025-11-20T00:00:00Z"
tags: ["supply-chain", "vulnerability-research", "xss", "javascript", "esbuild", "dev-server", "html-sanitization"]
phying_url: "https://phying.com/item/5443"
lang: en
---

# Esbuild's XSS Bug that Survived 5 Billion Downloads and Bypassed HTML Sanitization

## Summary

How a low-severity XSS flag in esbuild's dev server became real: a folder name containing a double quote escaped the escapeForHTML function, enabling script execution; the fix was one line.

## Intelligence Metadata

- **Sources:** depthfirst.com
- **Published:** 2025-11-20T00:00:00Z
- **Original:** https://depthfirst.com/research/esbuilds-xss-bug-that-survived-5-billion-downloads-and-bypassed-html-sanitization
- **Phying News:** https://phying.com/item/5443