{"uuid": "5cd3e264-2954-46ab-89f7-3988eb41315b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-gv7w-rqvm-qjhr", "type": "seen", "source": "https://gist.github.com/alon710/941b83f5e57b578e36f6f2a8a8b0f71f", "content": "# GHSA-GV7W-RQVM-QJHR: GHSA-GV7W-RQVM-QJHR: Remote Code Execution via Missing Binary Integrity Verification in esbuild Deno Integration\n\n> **CVSS Score:** 8.1\n> **Published:** 2026-06-12\n> **Full Report:** https://cvereports.com/reports/GHSA-GV7W-RQVM-QJHR\n\n## Summary\nAn issue was discovered in the Deno integration of the esbuild package. The module fails to verify the integrity of downloaded native binary packages from NPM registries before writing and executing them on the local filesystem. This allows an attacker who controls the NPM_CONFIG_REGISTRY environment variable or intercepts the network connection to execute arbitrary native code on the host machine.\n\n## TL;DR\nMissing binary integrity verification in esbuild's Deno installer allows unauthenticated remote code execution via a poisoned registry configuration.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-494, CWE-426\n- **Attack Vector**: Network / Local Environment Manipulation\n- **CVSS Score**: 8.1 (High)\n- **Exploit Status**: Proof of Concept (PoC) available\n- **CISA KEV Status**: Not Listed\n- **Impact**: Remote Code Execution (RCE)\n\n## Affected Systems\n\n- esbuild (Deno module)\n- **esbuild (Deno module)**: >= 0.17.0, < 0.28.1 (Fixed in: `0.28.1`)\n\n## Mitigation\n\n- Upgrade esbuild to version 0.28.1 or higher.\n- Avoid running Deno with --allow-all or --allow-run flags unless absolutely necessary.\n- Enforce strict network egress controls and audit environment variable manipulation.\n\n**Remediation Steps:**\n1. Identify all projects importing esbuild via Deno module paths.\n2. Update the import URLs or dependency locks to specify esbuild version 0.28.1 or higher.\n3. Restrict the run permissions of Deno tasks in CI/CD pipelines to block unauthorized native execution.\n\n## References\n\n- [GitHub Advisory Database Record](https://github.com/advisories/GHSA-gv7w-rqvm-qjhr)\n- [Repository Advisory Record](https://github.com/evanw/esbuild/security/advisories/GHSA-gv7w-rqvm-qjhr)\n- [Patched Version Release Tag](https://github.com/evanw/esbuild/releases/tag/v0.28.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-GV7W-RQVM-QJHR) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-06-15T12:11:47.000000Z"}