vite-plus vulnerabilities

Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file

Affected

>=1.0.0-rc.0 <1.3.0

Fixed in

1.3.0

Vite: Cross origin script execution through Vite custom middleware

Affected

<1.1.0

Fixed in

1.1.0

Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine

Affected

<1.1.0

Fixed in

1.1.0

Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`

Affected

>=0.2.8 <1.1.0

Fixed in

1.1.0

launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors

Affected

<1.1.0

Fixed in

1.1.0

launch-editor: `fs.existsSync()` existence check can be bypassed on Windows

Affected

<1.1.0

Fixed in

1.1.0

launch-editor: escapeCmdArgs() omits % escaping on Windows

Affected

<1.1.0

Fixed in

1.1.0

Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE

Affected

<0.1.24

Fixed in

0.1.24

launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows

Affected

<0.1.24

Fixed in

0.1.24

vite: `server.fs.deny` bypass on Windows alternate paths

Affected

<0.1.24

Fixed in

0.1.24

Path traversal in vite-plus/binding downloadPackageManager() writes outside VP_HOME

Affected

<0.1.17

Fixed in

0.1.17