Vite vulnerabilities

Vite is a frontend tooling framework for JavaScript that, prior to versions 8.0.16, 7.3.5, and 6.4.3, could return the contents of files specified by server.fs.deny to the browser on Windows. Issues with NTFS ADS path normalization allowed unauthorized access to sensitive files.

Vite, a frontend tooling framework for JavaScript, versions 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, has a vulnerability in handling .map requests for optimized dependencies. The dev server resolves file paths and calls readFile without restricting ../ segments in the URL, allowing bypass of the server.fs.strict allow list and retrieval of .map files outside the project root if they can be parsed as valid source map JSON.

Vite versions 7.1.0 to before 7.3.2 and 8.0.5 allow bypassing server.fs.deny restrictions. Files like .env or *.crt can be retrieved with HTTP 200 by appending query parameters ?raw, ?import&raw, or ?import&url&inline.

A vulnerability in Vite (a frontend tooling framework for JavaScript) from 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5 allows an attacker who can connect to the Vite dev server's WebSocket without an Origin header to invoke fetchModule via the vite:invoke event and read arbitrary files on the server as a JavaScript string. HTTP access controls are not applied to this WebSocket channel.

Vite is a frontend tooling framework for JavaScript. In versions from 2.9.18 to before 3.0.0, 3.2.9 to before 4.0.0, 4.5.3 to before 5.0.0, 5.2.6 to before 5.4.21, 6.0.0 to before 6.4.1, 7.0.0 to before 7.0.8, and 7.1.0 to before 7.1.11, files denied by server.fs.deny were sent if the URL ended with \ when the dev server was running on Windows. Only apps explicitly exposing the Vite dev server to the network and running the dev server on Windows were affected.

Vite before versions 7.1.5, 7.0.7, 6.3.6, and 5.4.20 serves any HTML files on the machine regardless of server.fs settings. Affects apps that expose the dev server to the network and use appType 'spa' or 'mpa'. The preview server is also vulnerable.

Vite, a frontend tooling, has a vulnerability that allows bypassing server options (`server.fs.deny`) using double forward-slash (//). This enables unauthenticated users to read files from the Vite application's root path, including default `fs.deny` settings.