vite vulnerabilities

Vite: Cross origin script execution through Vite custom middleware

Affected

>=8.3.0 <8.3.3 · >=8.2.0 <8.2.4 · >=8.0.0 <8.1.6 · >=7.0.0 <7.3.7 · <6.4.4

Fixed in

6.4.4, 7.3.7, 8.1.6, 8.2.4, 8.3.3

Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine

Affected

>=8.3.0 <8.3.3 · >=8.2.0 <8.2.4 · >=8.0.0 <8.1.6 · >=7.0.0 <7.3.7 · <6.4.4

Fixed in

6.4.4, 7.3.7, 8.1.6, 8.2.4, 8.3.3

Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`

Affected

>=8.3.0 <8.3.3 · >=8.2.0 <8.2.4

Fixed in

8.2.4, 8.3.3

launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors

Affected

>=8.3.0 <8.3.3 · >=8.2.0 <8.2.4 · >=8.0.0 <8.1.6 · >=7.0.0 <7.3.7 · <6.4.4

Fixed in

6.4.4, 7.3.7, 8.1.6, 8.2.4, 8.3.3

launch-editor: `fs.existsSync()` existence check can be bypassed on Windows

Affected

>=8.3.0 <8.3.3 · >=8.2.0 <8.2.4 · >=8.0.0 <8.1.6 · >=7.0.0 <7.3.7 · <6.4.4

Fixed in

6.4.4, 7.3.7, 8.1.6, 8.2.4, 8.3.3

launch-editor: escapeCmdArgs() omits % escaping on Windows

Affected

>=8.3.0 <8.3.3 · >=8.2.0 <8.2.4 · >=8.0.0 <8.1.6 · >=7.0.0 <7.3.7 · <6.4.4

Fixed in

6.4.4, 7.3.7, 8.1.6, 8.2.4, 8.3.3

launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows

Affected

>=8.0.0 <8.0.16 · >=7.0.0 <7.3.5 · <6.4.3

Fixed in

6.4.3, 7.3.5, 8.0.16

vite: `server.fs.deny` bypass on Windows alternate paths

Affected

>=8.0.0 <8.0.16 · >=7.0.0 <7.3.5 · <6.4.3

Fixed in

6.4.3, 7.3.5, 8.0.16

launch-editor vulnerable to command injection via the crafted request on Windows

Affected

<5.4.9

Fixed in

5.4.9

Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling

Affected

>=8.0.0 <8.0.5 · >=7.0.0 <7.3.2 · <6.4.2

Fixed in

6.4.2, 7.3.2, 8.0.5

Vite: `server.fs.deny` bypassed with queries

Affected

>=8.0.0 <8.0.5 · >=7.1.0 <7.3.2

Fixed in

7.3.2, 8.0.5

Vite Vulnerable to Arbitrary File Read via Vite Dev Server WebSocket

Affected

>=8.0.0 <8.0.5 · >=7.0.0 <7.3.2 · >=6.0.0 <6.4.2

Fixed in

6.4.2, 7.3.2, 8.0.5

vite allows server.fs.deny bypass via backslash on Windows

Affected

>=7.1.0 <7.1.11 · >=7.0.0 <7.0.8 · >=6.0.0 <6.4.1 · >=2.9.18 <5.4.21 · >=3.2.9 <5.4.21 · >=4.5.3 <5.4.21 · >=5.2.6 <5.4.21

Fixed in

5.4.21, 6.4.1, 7.0.8, 7.1.11

Vite middleware may serve files starting with the same name with the public directory

Affected

>=7.1.0 <7.1.5 · >=7.0.0 <7.0.7 · >=6.0.0 <6.3.6 · <5.4.20

Fixed in

5.4.20, 6.3.6, 7.0.7, 7.1.5

Vite's `server.fs` settings were not applied to HTML files

Affected

>=7.1.0 <7.1.5 · >=7.0.0 <7.0.7 · >=6.0.0 <6.3.6 · <5.4.20

Fixed in

5.4.20, 6.3.6, 7.0.7, 7.1.5

Vite's server.fs.deny bypassed with /. for files under project root

Affected

>=6.3.0 <6.3.4 · >=6.2.0 <6.2.7 · >=6.0.0 <6.1.6 · >=5.0.0 <5.4.19 · <4.5.14

Fixed in

4.5.14, 5.4.19, 6.1.6, 6.2.7, 6.3.4

Vite has an `server.fs.deny` bypass with an invalid `request-target`

Affected

>=6.2.0 <6.2.6 · >=6.1.0 <6.1.5 · >=6.0.0 <6.0.15 · >=5.0.0 <5.4.18 · <4.5.13

Fixed in

4.5.13, 5.4.18, 6.0.15, 6.1.5, 6.2.6

Vite allows server.fs.deny to be bypassed with .svg or relative paths

Affected

>=6.2.0 <6.2.5 · >=6.1.0 <6.1.4 · >=6.0.0 <6.0.14 · >=5.0.0 <5.4.17 · <4.5.12

Fixed in

4.5.12, 5.4.17, 6.0.14, 6.1.4, 6.2.5

Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query

Affected

>=6.2.0 <6.2.4 · >=6.1.0 <6.1.3 · >=6.0.0 <6.0.13 · >=5.0.0 <5.4.16 · <4.5.11

Fixed in

4.5.11, 5.4.16, 6.0.13, 6.1.3, 6.2.4

Vite bypasses server.fs.deny when using ?raw??

Affected

>=6.2.0 <6.2.3 · >=6.1.0 <6.1.2 · >=6.0.0 <6.0.12 · >=5.0.0 <5.4.15 · <4.5.10

Fixed in

4.5.10, 5.4.15, 6.0.12, 6.1.2, 6.2.3

Websites were able to send any requests to the development server and read the response in vite

Affected

>=6.0.0 <6.0.9 · >=5.0.0 <5.4.12 · <4.5.6

Fixed in

4.5.6, 5.4.12, 6.0.9

Vite DOM Clobbering gadget found in vite bundled scripts that leads to XSS

Affected

>=5.4.0 <5.4.6 · >=5.3.0 <5.3.6 · >=5.2.0 <5.2.14 · >=4.0.0 <4.5.4 · <3.2.11 · >=5.0.0 <5.1.8

Fixed in

3.2.11, 4.5.4, 5.1.8, 5.2.14, 5.3.6, 5.4.6

Vite's `server.fs.deny` is bypassed when using `?import&raw`

Affected

>=5.4.0 <5.4.6 · >=5.3.0 <5.3.6 · >=5.2.0 <5.2.14 · >=4.0.0 <4.5.4 · <3.2.11 · >=5.0.0 <5.1.8

Fixed in

3.2.11, 4.5.4, 5.1.8, 5.2.14, 5.3.6, 5.4.6

Vite's `server.fs.deny` did not deny requests for patterns with directories.

Affected

>=2.7.0 <2.9.18 · >=3.0.0 <3.2.10 · >=4.0.0 <4.5.3 · >=5.0.0 <5.0.13 · >=5.1.0 <5.1.7 · >=5.2.0 <5.2.6

Fixed in

2.9.18, 3.2.10, 4.5.3, 5.0.13, 5.1.7, 5.2.6

Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem

Affected

>=2.7.0 <2.9.17 · >=3.0.0 <3.2.8 · >=4.0.0 <4.5.2 · >=5.0.0 <5.0.12

Fixed in

2.9.17, 3.2.8, 4.5.2, 5.0.12

Vite XSS vulnerability in `server.transformIndexHtml` via URL payload

Affected

>=4.4.0 <4.4.12 · >=4.5.0 <4.5.1 · >=5.0.0 <5.0.5

Fixed in

4.4.12, 4.5.1, 5.0.5

Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)

Affected

<2.9.16 · >=3.0.2 <3.2.7 · >=4.0.0 <4.0.5 · >=4.1.0 <4.1.5 · >=4.2.0 <4.2.3 · >=4.3.0 <4.3.9

Fixed in

2.9.16, 3.2.7, 4.0.5, 4.1.5, 4.2.3, 4.3.9

Vite before v2.9.13 vulnerable to directory traversal via crafted URL to victim's service

Affected

<2.9.13 · >=3.0.0-alpha.0 <3.0.0-beta.4

Fixed in

2.9.13, 3.0.0-beta.4