@alexaegis/svelte-config (>=0.9.2, <=0.11.6), @builders-of-stuff/svelte-sui-wallet-adapter (>=0.7.5, <=1.1.3) +7 more potentially affected by CVE-2024-53262 via @sveltejs/kit (>=2.0.0, <=2.8.1)

@sveltejs/kit NPM version =2.0.0, =0.9.2, =0.7.5, =0.0.0-52469075, =10.0.1, =0.0.1-alpha.26, =0.0.10, =1.0.2, =1.0.3 Source cves: CVE-2024-53262 Source advisory: OSV:GHSA-MH2X-FCQH-FMQV...

GHSA-8JHW-289H-JH2G Vite's `server.fs.deny` did not deny requests for patterns with directories.

Summary Vite dev server option server.fs.deny did not deny requests for patterns with directories. An example of such a pattern is /foo//. Impact Only apps setting a custom server.fs.deny that includes a pattern with directories, and explicitly exposing the Vite dev server to the network using...

Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem

Summary Vite dev server option server.fs.deny can be bypassed on case-insensitive file systems using case-augmented versions of filenames. Notably this affects servers hosted on Windows. This bypass is similar to https://nvd.nist.gov/vuln/detail/CVE-2023-34092 -- with surface area reduced to host...

GHSA-C24V-8RFC-W8VW Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem

Summary Vite dev server option server.fs.deny can be bypassed on case-insensitive file systems using case-augmented versions of filenames. Notably this affects servers hosted on Windows. This bypass is similar to https://nvd.nist.gov/vuln/detail/CVE-2023-34092 -- with surface area reduced to host...

CVE-2024-23331 Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem

Vite is a frontend tooling framework for javascript. The Vite dev server option server.fs.deny can be bypassed on case-insensitive file systems using case-augmented versions of filenames. Notably this affects servers hosted on Windows. This bypass is similar to CVE-2023-34092 -- with surface area...