77 matches found
CVE-2025-30208-EXP
CVE-2025-30208-EXP Vite development server arbitrary file read vulnerability CVE-2025-30208, with wide coverage, simple exploitation, and no restrictions, posing a huge threat! Fofa search syntax: body="/@vite/client" Hunter search syntax: web.body="/@vite/client" Exp script usage -u to check -p...
CVE-2026-39363
CVE-2026-39363 — Vite Dev Server WebSocket Arbitrary File Read Batch Detection Disclaimer: This tool is intended for authorized security testing and educational research only. Users must comply with local laws and regulations; unauthorized scanning or attacking others' systems is illegal. The...
CVE-2025-30208
🔥 Vite Dev Server Vulnerability Scanner CVE-2025-30208 🚀 Overview This tool scans for CVE-2025-30208, a vulnerability in the Vite Dev Server. It allows security researchers to quickly detect vulnerable instances using multiple payloads. ⚡ Features ✅ Single URL scanning -u URL ✅ Mass scanning from...
CVE-2025-30208
CVE-2025-30208 Using a special raw import query string on a vite dev server, a attacker can read arbitrary files Summary of the CVE Vite dev servers before 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10 can bypass the server.fs.deny file access checks for @fs requests. Appending ?raw?? or ?import&raw??...
CVE-2025-30208-Series
CVE-2025-30208 & CVE-2025-31125 & CVE-2025-31486 1. Vulnerability Overview CVE-2025-30208, CVE-2025-31125 and CVE-2025-31486 are arbitrary file reading vulnerabilities in the Vite development server. These vulnerabilities allow an attacker to bypass access controls through specific URL parameters...
CVE-2025-30208
中文 | English Vite Dev Server Vulnerability Scanner 一个内外网通吃的自动化扫描器 An automated tool for scanning Vite development server vulnerabilities. This tool utilizes the FOFA API to collect potential targets and automatically detects specific vulnerabilities. Features Auto Automatic target asset collectio...
CVE-2026-39363
CVE-2026-39363 — Vite Dev Server Arbitrary File Read PoC A drop-in PoC for GHSA-p9ff-h696-f583. It reads arbitrary files from the machine running the dev server by calling fetchModule over an unauthenticated HMR WebSocket, bypassing the HTTP-layer server.fs.allow restriction. Affected Versions...
Vite Dev Server - Information Exposure
Vite is a frontend tooling framework for JavaScript. Before versions 6.3.4, 6.2.7, 6.1.6, 5.4.19, and 4.5.14, the contents of files in the project root that are denied by a file matching pattern can be returned to the browser. Only apps explicitly exposing the Vite dev server to the network using...
Vite Dev Server - Path Traversal in Optimized Deps .map Handling
Vite development server versions prior to 8.0.5, 7.3.2, and 6.4.2 are vulnerable to path traversal through the optimized dependencies sourcemap handler. The dev server's handling of .map requests for optimized dependencies resolves file paths via normalizePathpath.resolveroot, url.slice1 and call...
Files or Directories Accessible to External Parties
Overview @vitest/browser is a Browser running for Vitest Affected versions of this package are vulnerable to Files or Directories Accessible to External Parties via the Vite dev server's server.fs.deny configuration, which drops its built-in defaults blocking .env, certificates, .npmrc, etc...
Files or Directories Accessible to External Parties
Overview @vitest/ui is an UI for Vitest Affected versions of this package are vulnerable to Files or Directories Accessible to External Parties via the Vite dev server's server.fs.deny configuration, which drops its built-in defaults blocking .env, certificates, .npmrc, etc. whenever any value is...
Files or Directories Accessible to External Parties
Overview vite-plus is a The Unified Toolchain for the Web Affected versions of this package are vulnerable to Files or Directories Accessible to External Parties via the Vite dev server's server.fs.deny configuration, which drops its built-in defaults blocking .env, certificates, .npmrc, etc...
CVE-2026-112950 Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix
Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 4.1.11 until 4.1.12 and 5.0.3, isFileLoadingAllowed and the filesystem read interpret backslashes differently on Windows in packages/mocker/src/node/interceptorPlugin.ts. When a client can reach the Vite dev...
Malicious Package
Overview vite-dev-launcher is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious code in vite-dev-launcher (npm)
Source: amazon-inspector 9ac504b2228b7e2d5aab05aac8cb13072d87bc4f047f390d207c7712c7cdd123 The package presents as a Vite dev-server wrapper but its declared postinstall node./postinstall-run.cjs chains through lib/gradle/lifecycle/postinstall-entry.cjs and instrumentation-registry.cjs to...
Malicious code in vite-dev-launcher (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ac504b2228b7e2d5aab05aac8cb13072d87bc4f047f390d207c7712c7cdd123 The package presents as a Vite dev-server wrapper but its declared postinstall node./postinstall-run.cjs chains through...
MAL-2026-16474 Malicious code in vite-dev-launcher (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ac504b2228b7e2d5aab05aac8cb13072d87bc4f047f390d207c7712c7cdd123 The package presents as a Vite dev-server wrapper but its declared postinstall node./postinstall-run.cjs chains through...
Malicious Package
Overview vite-dev-launcher is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
EUVD-2026-69705
Vitest: Path Traversal / Arbitrary File Read via @vitest/mocker Redirect Mock...
Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root
Summary A browser-based cross-origin request flaw in the Tina dev server allows an attacker-controlled website to cause arbitrary file creation inside the configured media upload directory on a developer machine running tinacms dev. No manual file upload is required. The attacker page builds the...