CVE-2023-49293 Cross-site Scripting in `server.transformIndexHtml` via URL payload in vite

Vite is a website frontend framework. When Vite's HTML transformation is invoked manually via server.transformIndexHtml, the original request URL is passed in unmodified, and the html being transformed contains inline module scripts ..., it is possible to inject arbitrary HTML into the transforme...

CVE-2023-49293 Cross-site Scripting in `server.transformIndexHtml` via URL payload in vite

Vite is a website frontend framework. When Vite's HTML transformation is invoked manually via server.transformIndexHtml, the original request URL is passed in unmodified, and the html being transformed contains inline module scripts ..., it is possible to inject arbitrary HTML into the transforme...

CVE-2023-49293

Vite HTML transformation vulnerability (CVE-2023-49293) affects apps using appType: 'custom' with the default HTML middleware. When server.transformIndexHtml is invoked manually and the transformed HTML contains inline [removed], an unmodified request URL in the HTML being transformed can allow i...

CVE-2023-49293 Cross-site Scripting in `server.transformIndexHtml` via URL payload in vite

Vite is a website frontend framework. When Vite's HTML transformation is invoked manually via server.transformIndexHtml, the original request URL is passed in unmodified, and the html being transformed contains inline module scripts ..., it is possible to inject arbitrary HTML into the transforme...

PT-2023-7610

Name of the Vulnerable Software and Affected Versions Vite versions prior to 4.4.12 Vite versions prior to 4.5.1 Vite versions prior to 5.0.5 Description The issue is related to Vite's HTML transformation when invoked manually via server.transformIndexHtml. If the original request URL is passed i...

CVE-2023-49293: Improper Neutralization of Input During Web Page Generation

Vite is a website frontend framework. When Vite's HTML transformation is invoked manually via server.transformIndexHtml, the original request URL is passed in unmodified, and the html being transformed contains inline module scripts , it is possible to inject arbitrary HTML into the transformed...

GHSA-2RCP-JVR4-R259 Tauri's Updater Private Keys Possibly Leaked via Vite Environment Variables

Impact This advisory is not describing a vulnerability in the Tauri code base itself but a commonly used misconfiguration which could lead to leaking of the private key and updater key password into bundled Tauri applications using the Vite frontend in a specific configuration. The Tauri...

Tauri's Updater Private Keys Possibly Leaked via Vite Environment Variables

Impact This advisory is not describing a vulnerability in the Tauri code base itself but a commonly used misconfiguration which could lead to leaking of the private key and updater key password into bundled Tauri applications using the Vite frontend in a specific configuration. The Tauri...

CVE-2023-46115

Tauri is a framework for building binaries for all major desktop platforms. This advisory is not describing a vulnerability in the Tauri code base itself but a commonly used misconfiguration which could lead to leaking of the private key and updater key password into bundled Tauri applications...

Code injection

Tauri is a framework for building binaries for all major desktop platforms. This advisory is not describing a vulnerability in the Tauri code base itself but a commonly used misconfiguration which could lead to leaking of the private key and updater key password into bundled Tauri applications...

CVE-2023-46115

Technical details (affected versions, vulnerable components, exploit specifics) are not provided in the supplied documents. Monitor for updates from the vendors and CVE registries.

CVE-2023-46115 Updater Private Keys Possibly Leaked via Vite Environment Variables in tauri-cli

Tauri is a framework for building binaries for all major desktop platforms. This advisory is not describing a vulnerability in the Tauri code base itself but a commonly used misconfiguration which could lead to leaking of the private key and updater key password into bundled Tauri applications...

CVE-2023-46115 Updater Private Keys Possibly Leaked via Vite Environment Variables in tauri-cli

Tauri is a framework for building binaries for all major desktop platforms. This advisory is not describing a vulnerability in the Tauri code base itself but a commonly used misconfiguration which could lead to leaking of the private key and updater key password into bundled Tauri applications...

CVE-2023-46115 Updater Private Keys Possibly Leaked via Vite Environment Variables in tauri-cli

Tauri is a framework for building binaries for all major desktop platforms. This advisory is not describing a vulnerability in the Tauri code base itself but a commonly used misconfiguration which could lead to leaking of the private key and updater key password into bundled Tauri applications...

CVE-2023-46115: Exposure of Sensitive Information to an Unauthorized Actor

Tauri is a framework for building binaries for all major desktop platforms. This advisory is not describing a vulnerability in the Tauri code base itself but a commonly used misconfiguration which could lead to leaking of the private key and updater key password into bundled Tauri applications...

Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)

The issue involves a security vulnerability in Vite where the server options can be bypassed using a double forward slash //. This vulnerability poses a potential security risk as it can allow unauthorized access to sensitive directories and files. Steps to Fix. Update Vite: Ensure that you are...

@aem-vite/import-rewriter (>=5.0.1, <=6.0.1), @aem-vite/vite-aem-plugin (>=1.0.0-alpha.1, <=2.3.1) +210 more potentially affected by CVE-2023-34092 via vite (>=2.0.0-beta.4, <=2.9.15)

vite NPM version =2.0.0-beta.4, =5.0.1, =1.0.0-alpha.1, =3.0.0-beta.5, =3.0.0-beta.2, =0.9.1, =1.0.16, =1.1.0-next.4, =0.0.0-experimental-17c6886-20220324, =0.0.0-canary-20220428124037, =0.1.5, =0.0.11, =0.0.12, =0.0.1, =0.1.5, =0.0.11, =0.0.16 and more Source cves: CVE-2023-34092 Source advisory...

@alexaegis/setup-editorconfig (>=0.0.3, <=0.0.5), @alexaegis/setup-vite (>=0.0.3, <=0.0.5) +55 more potentially affected by CVE-2023-34092 via vite (>=4.2.0, <=4.2.2)

vite NPM version =4.2.0, =0.0.3, =0.0.3, =0.0.3, =0.0.3, =0.0.3, =0.0.5, =0.0.5, =0.0.5, =0.0.5, =16.0.0-next.7, =1.0.0-beta.0, =0.0.0-canary-20230317112045, =22.0.0 - @emhamzahazeen/config-vite 1.0.0 and more Source cves: CVE-2023-34092 Source advisory: OSV:GHSA-353F-5XF4-QW67...

@akrc/vidocs (>=0.0.0, <=0.0.2), @alexzzz/npms (>=0.0.5, <=0.2.0) +114 more potentially affected by CVE-2023-34092 via vite (>=3.0.2, <=3.2.5)

vite NPM version =3.0.2, =0.0.0, =0.0.5, =1.0.1, =1.0.1, =3.2.0, =0.0.37, =0.0.35, =0.2.3, =0.0.0-canary-20220914153453, =0.0.6, =0.1.0, =0.0.3, =6.24.0, =0.1.1, =0.1.23 and more Source cves: CVE-2023-34092 Source advisory: OSV:GHSA-353F-5XF4-QW67...

@brewer/beerui (>=1.1.9, <=1.1.16), @catalysisdev/build (0.8.0) +33 more potentially affected by CVE-2023-34092 via vite (>=4.0.0, <=4.0.4)

vite NPM version =4.0.0, =1.1.9, =0.0.0-canary-20221223101943, =5.3.4, =0.5.6, =0.7.2-alpha.0 and more Source cves: CVE-2023-34092 Source advisory: OSV:GHSA-353F-5XF4-QW67...