Update esbuild dependecy version to >=v0.25.0

[jendcruz22]

Summary

Strapi v5.12.0 currently depends on esbuild-register v2.21.0, which in turn pulls in esbuild version 0.20.2. This versions of esbuild is affected by a known vulnerability (GHSA-67mh-4wv8-2f99, CWE-346) that can allow unauthorized requests and data disclosure due to overly permissive CORS settings.
Updating esbuild-register's esbuild dependency to a patched version (≥0.25.0) would resolve this issue.

Details

Affected Version: esbuild-register v2.21.0; esbuild <=v0.24.0

Vulnerability Information

CVE Information: GHSA-67mh-4wv8-2f99

Severity: Moderate (CVSS Base Score: 5.3)

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

CWE: CWE-346 – Origin Validation Error

This addresses the CORS misconfiguration vulnerability that arises when esbuild sets Access-Control-Allow-Origin: * on all responses.

Vulnerability Details

Root Cause

esbuild versions earlier than 0.25.0, when used in development mode, set overly permissive CORS headers (Access-Control-Allow-Origin: *), allowing malicious websites to:

• Send requests to the development server.
• Read responses, potentially exposing source code or sensitive information.
  This vulnerability becomes a concern if the development server is exposed or misconfigured in production environments.

Impact

• Risk: Unauthorized websites may exploit this vulnerability to read responses from the development server, potentially exposing sensitive information.
• Severity Justification: While rated as moderate, the high confidence level and multiple evidence points (5) suggest addressing this issue promptly.

Recommendation

Update Recommendation: Upgrade the esbuild-register's esbuild dependency from v2.21.0 to v4.3.0 or later.