Vite Dev Server - Information Exposure

Vite dev server could allow reading files from the Vite project root by bypassing server.fs.deny with double forward-slash paths //. This affects exposed dev servers only. id: CVE-2023-34092 info: name: Vite Dev Server - Information Exposure author: ritikchaddha severity: high description: | Vite...

Vite Dev Server - Information Exposure

Vite is a frontend tooling framework for JavaScript. Before versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14, the contents of files in the project root that are denied by a file matching pattern can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network using...

Vite Dev Server - Directory Traversal

Vite is a modern frontend build tool. In Vite prior to versions 6.4.3, 6.3.4, and 5.4.23, a directory traversal vulnerability affects the Vite development server. When the Vite dev server is launched with the --host or server.host option, an unauthenticated attacker can craft a request with a pat...

CVE-2026-109965 Serena before 2.0.0 Symlink Following in File Tools Allows Access Outside Project Root

Serena before 2.0.0 contains an improper link resolution vulnerability that allows attackers to access files outside the project root by committing symlinks inside a repository. Project.ispathinproject normalizes paths lexically without resolving symlinks, so file tools like readfile and...

GHSA-7C4V-FWGW-9RF7 Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpoint

Impact When a Nuxt dev server is bound to a network-reachable interface for example nuxt dev --host for on-device testing, the default-enabled Chrome DevTools workspace endpoint GET /.well-known/appspecific/com.chrome.devtools.json returns the absolute project root workspace.root, i.e. rootDir an...

Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpoint

Impact When a Nuxt dev server is bound to a network-reachable interface for example nuxt dev --host for on-device testing, the default-enabled Chrome DevTools workspace endpoint GET /.well-known/appspecific/com.chrome.devtools.json returns the absolute project root workspace.root, i.e. rootDir an...

NPM: Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpoint

NPM: Nuxt dev server discloses project root and workspace UUID via the Chrome DevTools workspace endpoint vulnerability discovered by ? in WordPress Npm nuxt versions = 3.21.7, 3.21.10...

PT-2026-75941

Impact When a Nuxt dev server is bound to a network-reachable interface for example nuxt dev --host for on-device testing, the default-enabled Chrome DevTools workspace endpoint GET /.well-known/appspecific/com.chrome.devtools.json returns the absolute project root workspace.root, i.e. rootDir an...

MAL-2026-10724 Malicious code in @yuandc/aica (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9352926e7ceab9460eb3fecae1dfd1bcb9417efa9488e6f7f858149a47e1f31 Package runs a persistent worker invoked via the aica start CLI that long-polls the hardcoded endpoint https://aca.kinghon.com.cn:8843/ for three...

PYSEC-2026-1456 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in hyper-bump-it

Summary hyper-bump-it reads a file glob pattern from the configuration file. That is combined with the project root directory to construct a full glob pattern that is used to find files that should be edited. These matched files should be contained within the project root directory, but that is n...

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in hyper-bump-it

Summaryhyper-bump-it reads a file glob pattern from the configuration file. That is combined with the project root directory to construct a full glob pattern that is used to find files that should be edited. These matched files should be contained within the project root directory, but that is no...

PT-2026-51433

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 29.0 Description AVideo exposes sensitive .env files to unauthenticated users when deployed using the official Docker compose configuration. The docker-compose.yml file mounts the entire project root directory as the...

GHSA-G8MR-85JM-7XHM Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE

Summary Vitest Browser Mode exposes a cdp API that forwards raw Chrome DevTools Protocol CDP methods over the Vitest browser WebSocket RPC. CDP is not gated by browser.api.allowWrite, browser.api.allowExec, api.allowWrite, or api.allowExec. As a result, disabling Browser Mode write and exec...

PT-2026-52658

Summary When running nuxt dev, Nuxt registers an unauthenticated route at /.well-known/appspecific/com.chrome.devtools.json that returns the absolute filesystem path of the project root and a per-project UUID persisted to node modules/.cache/nuxt/chrome-workspace.json. The route is enabled by...

EUVD-2026-35400

TYPO3 CMS has Broken Access Control in its File Abstraction Layer...

GHSA-JF56-V8JC-JCC5 TYPO3 CMS has Broken Access Control in its File Abstraction Layer

Problem The path allowance check in GeneralUtility::isAllowedAbsPath performed a plain string prefix comparison without requiring a directory separator boundary, causing a path like /var/www/html-other/secret.yaml to be incorrectly accepted as valid when the project root was /var/www/html...

MAL-2026-5587 Malicious code in 0x2ai-demo1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fdc7c661d4867578d3dd920010bccc1e79fcae8753b5bf549f44ea8a45cde502 On npm install, scripts/postinstall.cjs runs fs.cpSyncpayload, cwd, recursive: true with cwd=process.env.INITCWD || process.cwd — recursively writing...

Malicious code in 0x2ai-demo9x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e796c3398589b92ecd70f45bc41128101313dd07adeb0634199ac3fef59d19d On npm install, scripts/postinstall.cjs copies the package's payload/ tree into the installer's project root process.env.INITCWD without consent,...

CVE-2026-49738

The path allowance check in GeneralUtility::isAllowedAbsPath performed a plain string prefix comparison without requiring a directory separator boundary, causing a path like /var/www/html-other/secret.yaml to be incorrectly accepted as valid when the project root was /var/www/html. Administrator...

CVE-2026-49738

The path allowance check in GeneralUtility::isAllowedAbsPath performed a plain string prefix comparison without requiring a directory separator boundary, causing a path like /var/www/html-other/secret.yaml to be incorrectly accepted as valid when the project root was /var/www/html. Administrator...