12 matches found
Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`
Summary The first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance. Impact Only apps that match one of the following conditions are affected: - explicitly expose the Vite dev server to the network using --host or the...
npm: Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`
npm: Vite: First 4 bytes of files outside of server.fs setting is exposed by ?vite-wasm-instance vulnerability discovered by ? in WordPress npm vite versions = 8.2.0, = 8.2.3...
GHSA-VFPM-58RQ-9QCG Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`
Summary The first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance. Impact Only apps that match one of the following conditions are affected: - explicitly expose the Vite dev server to the network using --host or the...
UBUNTU-CVE-2026-112947
Vite is a frontend tooling framework for JavaScript. From 8.2.0 until 8.2.4 and 8.3.3, the first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance. Requests containing the ?vite-wasm-instance query are handled by the internal...
npm: Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`
npm: Vite: First 4 bytes of files outside of server.fs setting is exposed by ?vite-wasm-instance vulnerability discovered by ? in WordPress npm vite-plus versions = 0.2.8, = 1.0.0...
CVE-2026-112947
Vite is a frontend tooling framework for JavaScript. From 8.2.0 until 8.2.4 and 8.3.3, the first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance. Requests containing the ?vite-wasm-instance query are handled by the internal...
CVE-2026-112947 Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`
Vite is a frontend tooling framework for JavaScript. From 8.2.0 until 8.2.4 and 8.3.3, the first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance. Requests containing the ?vite-wasm-instance query are handled by the internal...
CVE-2026-112947
The Vite frontend tooling framework (versions 8.2.0 through 8.2.4 and 8.3.3 ) is vulnerable to a path traversal and information exposure flaw. An attacker can request files outside the server.fs setting by using the ?vite-wasm-instance query parameter. The internal Wasm plugin's load hook handles...
CVE-2026-112947 Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`
Vite is a frontend tooling framework for JavaScript. From 8.2.0 until 8.2.4 and 8.3.3, the first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance. Requests containing the ?vite-wasm-instance query are handled by the internal...
CVE-2026-112947
Vite is a frontend tooling framework for JavaScript. From 8.2.0 until 8.2.4 and 8.3.3, the first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance. Requests containing the ?vite-wasm-instance query are handled by the internal...
CVE-2026-112947 Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance`
Vite is a frontend tooling framework for JavaScript. From 8.2.0 until 8.2.4 and 8.3.3, the first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance. Requests containing the ?vite-wasm-instance query are handled by the internal...
Vite information leakage vulnerability
Vite versions from 8.3.0 to 8.3.3 and from 8.2.0 to 8.2.4, as well as vite-plus version 0.2.8 to 1.1.0, have security vulnerabilities. The vulnerability stems from the Wasm plugin load hook not applying the server.fs check. When processing requests containing the?vite-wasm-instance query, the...