vite allows server.fs.deny bypass via backslash on Windows

Summary Files denied by server.fs.deny were sent if the URL ended with \ when the dev server is running on Windows. Impact Only apps that match the following conditions are affected: - explicitly exposes the Vite dev server to the network using --host or server.host config option - running the de...

GHSA-93M4-6634-74Q7 vite allows server.fs.deny bypass via backslash on Windows

Summary Files denied by server.fs.deny were sent if the URL ended with \ when the dev server is running on Windows. Impact Only apps that match the following conditions are affected: - explicitly exposes the Vite dev server to the network using --host or server.host config option - running the de...

@angular/build (>=20.2.0-next.3 <=21.0.0-next.8), @brendonovich/solidjs__start (>=0.0.0 <=0.0.3) +8 more potentially affected by CVE-2025-62522 via vite (>=7.1.0 <=7.1.10)

vite NPM version =7.1.0, =20.2.0-next.3, =0.0.0, =2.20.3, =2.20.3, =0.0.12, =2.2.17, =2.2.17, =1.0.0, =2.20.3, =0.25.0-alpha.0, =0.25.0-alpha.1 Source cves: CVE-2025-62522 Source advisory: OSV:GHSA-93M4-6634-74Q7...

@angular/build (>=20.1.0 <=20.2.0-next.2), @atomazing-org/super-app-host (>=0.0.4 <=0.0.8) +55 more potentially affected by CVE-2025-62522 via vite (>=7.0.0 <=7.0.6)

vite NPM version =7.0.0, =20.1.0, =0.0.4, =0.2.9, =1.190.0, =0.1.0, =0.0.1750946288791, =0.0.2, =0.0.7, =0.0.2, =0.0.1, =0.1.34, =0.1.35 and more Source cves: CVE-2025-62522 Source advisory: OSV:GHSA-93M4-6634-74Q7...

@1771technologies/oneplay (>=0.0.1 <=0.0.6), @aicblock/cli (>=1.0.0 <=1.0.1) +170 more potentially affected by CVE-2025-62522 via vite (>=6.0.0 <=6.4.0)

vite NPM version =6.0.0, =0.0.1, =1.0.0, =1.0.0, =0.2.0, =4.25.19-patch.2, =19.1.0, =0.55.0, =0.21.2-4.1, =0.4.2, =0.1.10, =0.0.1, =4.0.0-canary.13656, =4.0.0-canary.13656, =4.0.0-canary.13657 and more Source cves: CVE-2025-62522 Source advisory: OSV:GHSA-93M4-6634-74Q7...

@adhd/react-hooks (=2.2.1), @aklesky/vite-config (>=0.7.9 <=0.9.0) +466 more potentially affected by CVE-2025-62522 via vite (>=4.5.3 <=5.4.20)

vite NPM version =4.5.3, =0.7.9, =16.0.0, =16.0.0, =16.2.14, =18.0.0, =1.0.25-beta.0, =0.1.26, =0.1.25, =0.1.30, =0.1.32, =0.5.0, =0.5.5 - @avorati/strapi-plugin-preview =1.0.1 - @beardeddudes/strapi-types =0.1.1 and more Source cves: CVE-2025-62522 Source advisory: OSV:GHSA-93M4-6634-74Q7...

128981semzub (=1.0.1), 1food-menu (>=0.3.0 <=0.3.7) +3488 more potentially affected by CVE-2025-62522 via vite (>=4.0.0-beta.0 <=5.4.20)

vite NPM version =4.0.0-beta.0, =0.3.0, =1.0.0, =2.0.3, =0.0.1, =0.0.1, =0.0.7, =4.0.61, =4.0.61, =4.0.61, =4.0.61, =0.0.1, =0.0.3 and more Source cves: CVE-2025-62522 Source advisory: OSV:GHSA-93M4-6634-74Q7...

@angular-devkit/build-angular (>=17.3.12 <=17.3.15), @angular/build (>=18.1.0 <=19.0.7) +167 more potentially affected by CVE-2025-62522 via vite (>=5.2.6 <=5.4.20)

vite NPM version =5.2.6, =17.3.12, =18.1.0, =2.0.0-beta.3, =0.36.1, =0.1.2, =5.30.1, =0.9.1-next.19, =0.9.1-next.19, =0.9.1-next.19, =0.0.4, =0.21.1, =1.0.375, =1.0.409 - @cotofe/appkit-cdn =2.0.0 - @curatorjs/bridge =0.1.0 and more Source cves: CVE-2025-62522 Source advisory:...

128981semzub (=1.0.1), 1food-menu (>=0.0.1 <=0.3.7) +5333 more potentially affected by CVE-2025-62522 via vite (>=2.9.18 <=5.4.20)

vite NPM version =2.9.18, =0.0.1, =1.0.0, =1.0.0, =2.0.3, =0.0.1, =0.0.1, =0.0.7, =4.0.61, =4.0.61, =4.0.61, =4.0.84 and more Source cves: CVE-2025-62522 Source advisory: OSV:GHSA-93M4-6634-74Q7...

PT-2025-42804

Name of the Vulnerable Software and Affected Versions Vite versions 2.9.18 through 3.0.0 Vite versions 3.2.9 through 4.0.0 Vite versions 4.5.3 through 5.0.0 Vite versions 5.2.6 through 5.4.21 Vite versions 6.0.0 through 6.4.1 Vite versions 7.0.0 through 7.0.8 Vite versions 7.1.0 through 7.1.11...

Vite 路径遍历漏洞

Vite is a new front-end build tool open-sourced by Vite. Vite suffers from a path traversal vulnerability that stems from a server.fs.deny rejected file being sent at the end of a URL in Windows environments, which could lead to information disclosure. The following versions are affected: version...

Malicious Package

Overview vite-tsconfig-optimized is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

Malicious Package

Overview vite-react-chunker is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview vite-logeidit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview vite-chunk-manager is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview vite-plugin-react-ping is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious Package

Overview vite-chunk-tools is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview vite-ts-icon is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview vite-binding-js is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview vite-linting-js is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...