CVE-2023-46115 Updater Private Keys Possibly Leaked via Vite Environment Variables in tauri-cli

Tauri is a framework for building binaries for all major desktop platforms. This advisory is not describing a vulnerability in the Tauri code base itself but a commonly used misconfiguration which could lead to leaking of the private key and updater key password into bundled Tauri applications...

CVE-2023-46115

Technical details (affected versions, vulnerable components, exploit specifics) are not provided in the supplied documents. Monitor for updates from the vendors and CVE registries.

CVE-2023-46115 Updater Private Keys Possibly Leaked via Vite Environment Variables in tauri-cli

Tauri is a framework for building binaries for all major desktop platforms. This advisory is not describing a vulnerability in the Tauri code base itself but a commonly used misconfiguration which could lead to leaking of the private key and updater key password into bundled Tauri applications...

urdfjsx (>=0.1.3 <=0.1.4), vite-plugin-vue-css-modules (>=3.1.4 <=4.0.1) potentially affected by CVE-2023-45133 via @babel/traverse (>=8.0.0-alpha.11 <=8.0.0-alpha.2)

@babel/traverse NPM version =8.0.0-alpha.11, =0.1.3, =3.1.4, =4.0.1 Source cves: CVE-2023-45133 Source advisory: OSV:GHSA-67HX-6X53-JW92...

@cfpreview/pages-e2e-test-runner-cli (>=0.0.9 <=0.0.25), @cloudflare/vite-plugin (>=0.0.0-0a9a26099 <=0.0.0-fec45ed61) +5 more potentially affected by CVE-2023-3348 via wrangler (>=0.0.0-a18155fb8 <=2.0.23)

wrangler NPM version =0.0.0-a18155fb8, =0.0.9, =0.0.0-0a9a26099, =0.0.1, =0.0.84-test.20250522015638, =1.0.0, =2.1.7 Source cves: CVE-2023-3348 Source advisory: OSV:GHSA-8C93-4HCH-XGXP...

@aem-vite/import-rewriter (>=5.0.1 <=6.0.1), @aem-vite/vite-aem-plugin (>=1.0.0 <=2.3.1) +220 more potentially affected by CVE-2023-34092 via vite (>=0.14.4 <=2.9.15)

vite NPM version =0.14.4, =5.0.1, =1.0.0, =3.0.0-beta.5, =3.0.0-beta.2, =0.0.1, =0.10.0, =1.0.16, =1.1.0-next.4, =0.0.0-experimental-17c6886-20220324, =0.0.0-canary-20220428124037, =0.1.5, =0.0.11, =0.0.12, =0.0.1, =0.1.5, =0.1.11 and more Source cves: CVE-2023-34092 Source advisory:...

@alioth_91/alita (>=3.3.9-patch.1 <=3.3.9-patch.2), @alitajs/vue-i18n (>=0.0.7 <=0.0.8) +98 more potentially affected by CVE-2023-34092 via vite (>=4.3.0 <=4.3.8)

vite NPM version =4.3.0, =3.3.9-patch.1, =0.0.7, =0.0.7, =0.0.7, =0.0.7, =0.0.7, =0.0.1, =0.0.1, =16.0.0, =2.0.0, =12.0.0, =0.0.0-canary-20230426131112, =0.0.1, =0.0.12 - @deconz-community/directus-extension-ddf-store =0.1.0 and more Source cves: CVE-2023-34092 Source advisory:...

@4399ywkf/bundler-vite (>=4.0.61 <=4.0.84), @4399ywkf/js (>=4.0.61 <=4.0.84) +46 more potentially affected by CVE-2023-34092 via vite (>=4.1.0 <=4.1.4)

vite NPM version =4.1.0, =4.0.61, =4.0.61, =4.0.61, =4.0.61, =0.0.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.0-canary-20230215113341, =4.6.2, =11.6.5, =5.3.8, =5.0.0, =5.0.1 and more Source cves: CVE-2023-34092 Source advisory: OSV:GHSA-353F-5XF4-QW67...

@brewer/beerui (>=1.1.9 <=1.1.16-beta-8), @catalysisdev/build (=0.8.0) +32 more potentially affected by CVE-2023-34092 via vite (>=4.0.0 <=4.0.4)

vite NPM version =4.0.0, =1.1.9, =0.0.0-canary-20221223101943, =5.3.4, =0.5.6, =0.7.2-alpha.0 and more Source cves: CVE-2023-34092 Source advisory: OSV:GHSA-353F-5XF4-QW67...

1food-menu (>=0.0.1 <=0.2.3), 7qb-cli (=2.0.0) +1096 more potentially affected by CVE-2023-34092 via vite (>=3.0.2 <=3.2.5)

vite NPM version =3.0.2, =0.0.1, =2.0.0, =1.0.1, =1.0.2, =0.0.42-beta1, =0.0.0, =0.0.5, =1.2.56-alpha.0, =1.3.4, =1.0.0, =1.0.22, =1.0.7, =1.2.60 and more Source cves: CVE-2023-34092 Source advisory: OSV:GHSA-353F-5XF4-QW67...

@alexaegis/setup-editorconfig (>=0.0.3 <=0.0.5), @alexaegis/setup-vite (>=0.0.3 <=0.0.5) +55 more potentially affected by CVE-2023-34092 via vite (>=4.2.0 <=4.2.2)

vite NPM version =4.2.0, =0.0.3, =0.0.3, =0.0.3, =0.0.3, =0.0.3, =0.0.5, =0.0.5, =0.0.5, =0.0.5, =16.0.0-next.7, =1.0.0-beta.0, =0.0.0-canary-20230317112045, =22.0.0 - @emhamzahazeen/config-vite =1.0.0 and more Source cves: CVE-2023-34092 Source advisory: OSV:GHSA-353F-5XF4-QW67...

GHSA-353F-5XF4-QW67 Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)

The issue involves a security vulnerability in Vite where the server options can be bypassed using a double forward slash //. This vulnerability poses a potential security risk as it can allow unauthorized access to sensitive directories and files. Steps to Fix. Update Vite: Ensure that you are...

Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)

The issue involves a security vulnerability in Vite where the server options can be bypassed using a double forward slash //. This vulnerability poses a potential security risk as it can allow unauthorized access to sensitive directories and files. Steps to Fix. Update Vite: Ensure that you are...

CVE-2023-34092

Vite provides frontend tooling. Prior to versions 2.9.16, 3.2.7, 4.0.5, 4.1.5, 4.2.3, and 4.3.9, Vite Server Options server.fs.deny can be bypassed using double forward-slash // allows any unauthenticated user to read file from the Vite root-path of the application including the default fs.deny...

Design/Logic Flaw

Vite provides frontend tooling. Prior to versions 2.9.16, 3.2.7, 4.0.5, 4.1.5, 4.2.3, and 4.3.9, Vite Server Options server.fs.deny can be bypassed using double forward-slash // allows any unauthenticated user to read file from the Vite root-path of the application including the default fs.deny...

CVE-2023-34092 Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)

Vite provides frontend tooling. Prior to versions 2.9.16, 3.2.7, 4.0.5, 4.1.5, 4.2.3, and 4.3.9, Vite Server Options server.fs.deny can be bypassed using double forward-slash // allows any unauthenticated user to read file from the Vite root-path of the application including the default fs.deny...

CVE-2023-34092

Vite core fix for CVE-2023-34092 (also echoed in related CVEs) describes a bypass of server.fs.deny via double-slash to read files from the Vite project root when the dev server is exposed (–host or server.host). Affected versions before the fixes include: 2.9.16, 3.2.7, 4.0.5, 4.1.5, 4.2.3, and ...

CVE-2023-34092 Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)

Vite provides frontend tooling. Prior to versions 2.9.16, 3.2.7, 4.0.5, 4.1.5, 4.2.3, and 4.3.9, Vite Server Options server.fs.deny can be bypassed using double forward-slash // allows any unauthenticated user to read file from the Vite root-path of the application including the default fs.deny...

CVE-2023-34092 Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)

Vite provides frontend tooling. Prior to versions 2.9.16, 3.2.7, 4.0.5, 4.1.5, 4.2.3, and 4.3.9, Vite Server Options server.fs.deny can be bypassed using double forward-slash // allows any unauthenticated user to read file from the Vite root-path of the application including the default fs.deny...

PT-2023-24665

Name of the Vulnerable Software and Affected Versions Vite versions prior to 2.9.16 Vite versions prior to 3.2.7 Vite versions prior to 4.0.5 Vite versions prior to 4.1.5 Vite versions prior to 4.2.3 Vite versions prior to 4.3.9 Description The issue involves a security risk in Vite where the...