CVE-2023-34092
HighCVSS 7.5Exploitation Probability (EPSS)
High risk86th percentile - higher than 86% of all known CVEs
Summary
Vite, a frontend tooling, has a vulnerability that allows bypassing server options (`server.fs.deny`) using double forward-slash (//). This enables unauthenticated users to read files from the Vite application's root path, including default `fs.deny` settings.
Risk Assessment
Organizations exposing the Vite dev server to the network may be at risk of leaking sensitive files, potentially leading to the disclosure of configuration data and certificates.
Recommendation
It is recommended to update Vite to versions 4.3.9, 4.2.3, 4.1.5, 4.0.5, 3.2.7, or 2.9.16 to mitigate this vulnerability. Additionally, avoid exposing the dev server to the public network.
Other vulnerabilities in Vite
See all- CVE-2025-31125MediumActively exploited
Vite is a frontend tooling framework for javascript. Vite exposes content of non-allowed files using ?inline&import or ?raw?import. Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected. This vulnerability is fixed in 6.2.4, 6.1.3, 6.0.13, 5.4.16, and 4.5.11.
- CVE-2026-53571High
Vite is a frontend tooling framework for JavaScript that, prior to versions 8.0.16, 7.3.5, and 6.4.3, could return the contents of files specified by server.fs.deny to the browser on Windows. Issues with NTFS ADS path normalization allowed unauthorized access to sensitive files.
- CVE-2026-39365Medium
Vite, a frontend tooling framework for JavaScript, versions 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, has a vulnerability in handling .map requests for optimized dependencies. The dev server resolves file paths and calls readFile without restricting ../ segments in the URL, allowing bypass of the server.fs.strict allow list and retrieval of .map files outside the project root if they can be parsed as valid source map JSON.
- CVE-2026-39364High
Vite versions 7.1.0 to before 7.3.2 and 8.0.5 allow bypassing server.fs.deny restrictions. Files like .env or *.crt can be retrieved with HTTP 200 by appending query parameters ?raw, ?import&raw, or ?import&url&inline.
- CVE-2026-39363High
A vulnerability in Vite (a frontend tooling framework for JavaScript) from 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5 allows an attacker who can connect to the Vite dev server's WebSocket without an Origin header to invoke fetchModule via the vite:invoke event and read arbitrary files on the server as a JavaScript string. HTTP access controls are not applied to this WebSocket channel.
- CVE-2025-62522Medium
Vite is a frontend tooling framework for JavaScript. In versions from 2.9.18 to before 3.0.0, 3.2.9 to before 4.0.0, 4.5.3 to before 5.0.0, 5.2.6 to before 5.4.21, 6.0.0 to before 6.4.1, 7.0.0 to before 7.0.8, and 7.1.0 to before 7.1.11, files denied by server.fs.deny were sent if the URL ended with \ when the dev server was running on Windows. Only apps explicitly exposing the Vite dev server to the network and running the dev server on Windows were affected.
- CVE-2025-58752Medium
Vite before versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20 serves any HTML files on the machine regardless of server.fs settings. Affects apps that expose the dev server to the network and use appType 'spa' or 'mpa'. The preview server is also vulnerable.
Original NVD description (English source)
Vite provides frontend tooling. Prior to versions 2.9.16, 3.2.7, 4.0.5, 4.1.5, 4.2.3, and 4.3.9, Vite Server Options (`server.fs.deny`) can be bypassed using double forward-slash (//) allows any unauthenticated user to read file from the Vite root-path of the application including the default `fs.deny` settings (`['.env', '.env.*', '*.{crt,pem}']`). Only users explicitly exposing the Vite dev server to the network (using `--host` or `server.host` config option) are affected, and only files in the immediate Vite project root folder could be exposed. This issue is fixed in [email protected], [email protected], [email protected], [email protected], [email protected], and [email protected].
Vulnerability data from NVD (NIST) · CISA KEV · EPSS