CVE-2023-45288

[eXaminator]

It seems there is a CVE in Go: https://avd.aquasec.com/nvd/cve-2023-45288

Trivvy finds this CVE in our project using esbuild through tsx:

[evanw]

This vulnerability is irrelevant in a development server that is never exposed to the internet. See esbuild’s documentation about the development server:

Note that this web server is intended to only be used in development. Do not use this in production.

and the FAQ entry about noise from vulnerability scanners:

These reports are benign and should be ignored. … Later versions of Go have dropped support for certain older platforms that I want esbuild to be able to run on (e.g. older versions of macOS).

[evanw]

I'm closing this issue as it's irrelevant, as described above.

[coolbeatz71]

I'm facing the same issue. Any fix? golang must be updated to version 1.21.9 or above. I can propose a PR for that @evanw