-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| esbuild | npm | <= 0.24.2 | 0.25.0 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the esbuild development server setting the Access-Control-Allow-Origin: * header for all requests, including the SSE connection. This allows any website to make requests to the development server and read the responses. The provided commit patch de85afd65edec9ebc44a11e245fd9e9a2e99760d directly addresses this by removing the overly permissive CORS header and adding host checking.
The ServeHTTP function in pkg/api/serve_other.go was responsible for handling general HTTP requests and previously set this header. The patch removed this line and added host validation logic.
The serveEventStream function in the same file was responsible for the SSE endpoint and also previously set this permissive header, which was removed in the patch.
Both functions are methods of the apiHandler struct. Therefore, these two functions are identified as the vulnerable functions as they were directly involved in setting the insecure CORS policy that led to the vulnerability.