@akrc/vidocs (>=0.0.0, <=0.0.2), @alexzzz/npms (>=0.0.5, <=0.2.0) +134 more potentially affected by CVE-2024-45811 via vite (>=3.0.0-alpha.2, <=3.2.8)

vite NPM version =3.0.0-alpha.2, =0.0.0, =0.0.5, =1.0.1, =1.0.1, =3.2.0, =1.11.2, =0.0.37, =0.0.35, =0.2.3, =0.0.0-canary-20220718083044, =0.0.6, =0.1.0, =0.0.3, =6.24.0, =7.12.2 and more Source cves: CVE-2024-45811 Source advisory: GHSA-9CWX-2883-4WFX...

@4399ywkf/bundler-vite (>=4.0.61, <=4.0.84), @4399ywkf/js (>=4.0.61, <=4.0.84) +486 more potentially affected by CVE-2024-45811 via vite (>=4.0.0, <=4.5.3)

vite NPM version =4.0.0, =4.0.61, =4.0.61, =4.0.61, =4.0.61, =0.0.1, =0.0.0, =0.0.1, =0.0.3, =0.0.1, =0.0.1, =0.0.1, =3.3.9-patch.1, =3.3.9-patch.2 and more Source cves: CVE-2024-45811 Source advisory: OSV:GHSA-9CWX-2883-4WFX...

@angular-devkit/build-angular (>=18.0.0-next.0, <=18.1.0-next.2), @angular/build (>=18.0.0-next.3, <=18.1.0-next.2) +98 more potentially affected by CVE-2024-45811 via vite (>=5.2.0, <=5.2.13)

vite NPM version =5.2.0, =18.0.0-next.0, =18.0.0-next.3, =0.36.1-fix1, =0.21.1, =1.0.375, =1.1.0, =5.0.0-alpha.4, =0.1.0-rc.8, =0.0.3, =0.0.22, =18.0.0-next.1, =18.0.0-next.1, =3.0.2, =3.2.12 and more Source cves: CVE-2024-45811 Source advisory: GHSA-9CWX-2883-4WFX...

@angular-devkit/build-angular (>=18.1.0-next.3, <=18.2.0-rc.0), @angular/build (>=18.1.0-next.3, <=18.2.0-rc.0) +43 more potentially affected by CVE-2024-45811 via vite (>=5.3.0, <=5.3.5)

vite NPM version =5.3.0, =18.1.0-next.3, =18.1.0-next.3, =2.0.0-beta.3, =0.44.0, =5.0.0-alpha.11, =18.1.0-snapshot-1721253261323, =18.1.0-snapshot-1721253261323, =1.0.1, =11.17.8, =0.0.1, =14.190.0-FUI-2012.1, =0.0.1719809477737, =8.1.1, =8.5.5 - @hybrbase-front/cli 1.0.0 -...

@angular-devkit/build-angular (>=18.2.0, <=19.0.0-next.6), @angular/build (>=18.2.0, <=19.0.0-next.6) +44 more potentially affected by CVE-2024-45811 via vite (>=5.4.0, <=5.4.5)

vite NPM version =5.4.0, =18.2.0, =18.2.0, =0.0.1-alpha.0, =1.0.1, =2025.1.17-950, =2025.2.11-1732, =18.2.0-snapshot-1724807614589, =18.2.0-snapshot-1724807614589, =2.2.1, =2.3.0, =0.0.1724939132543, =8.6.0, =1.0.15, =2.23.16, =2.27.11 and more Source cves: CVE-2024-45811 Source advisory:...

Vite's `server.fs.deny` is bypassed when using `?import&raw`

Summary The contents of arbitrary files can be returned to the browser. Details @fs denies access to files outside of Vite serving allow list. Adding ?import&raw to the URL bypasses this limitation and returns the file content if it exists. PoC sh $ npm create vite@latest $ cd vite-project/ $ npm...

GHSA-9CWX-2883-4WFX Vite's `server.fs.deny` is bypassed when using `?import&raw`

Summary The contents of arbitrary files can be returned to the browser. Details @fs denies access to files outside of Vite serving allow list. Adding ?import&raw to the URL bypasses this limitation and returns the file content if it exists. PoC sh $ npm create vite@latest $ cd vite-project/ $ npm...

@4399ywkf/bundler-vite (>=4.0.61, <=4.0.84), @4399ywkf/js (>=4.0.61, <=4.0.84) +486 more potentially affected by CVE-2024-45811 via vite (>=4.0.0, <=4.5.3)

vite NPM version =4.0.0, =4.0.61, =4.0.61, =4.0.61, =4.0.61, =0.0.1, =0.0.0, =0.0.1, =0.0.3, =0.0.1, =0.0.1, =0.0.1, =3.3.9-patch.1, =3.3.9-patch.2 and more Source cves: CVE-2024-45811 Source advisory: GHSA-9CWX-2883-4WFX...

GHSA-9CWX-2883-4WFX vulnerabilities

Vulnerabilities for packages: vite...

CVE-2024-45811: Exposure of Sensitive Information to an Unauthorized Actor

Vite a frontend build tooling framework for javascript. In affected versions the contents of arbitrary files can be returned to the browser. @fs denies access to files outside of Vite serving allow list. Adding ?import&raw to the URL bypasses this limitation and returns the file content if it...

PT-2024-31792

Name of the Vulnerable Software and Affected Versions: Vite versions prior to 3.2.11 Vite versions prior to 4.5.5 Vite versions prior to 5.2.14 Vite versions prior to 5.3.6 Vite versions prior to 5.4.6 Description: The contents of arbitrary files can be returned to the browser. @fs denies access ...

Vite Access Control Vulnerability

Vite is a new front-end builder tool from the Vite open source. Vite suffers from an access control error vulnerability that stems from the fact that the contents of any file can be returned to the browser...

Vite cross-site scripting vulnerabilities

Vite is a new front-end builder tool open-sourced by Vite. A cross-site scripting vulnerability exists in Vite. An attacker exploiting this vulnerability could perform a cross-site scripting attack...

CVE-2024-45812: Improper Neutralization of Input During Web Page Generation

Vite a frontend build tooling framework for javascript. Affected versions of vite were discovered to contain a DOM Clobbering vulnerability when building scripts to cjs/iife/umd output format. The DOM Clobbering gadget in the module can lead to cross-site scripting XSS in web pages where scriptle...

PT-2024-31793 · Vite · Vite

Name of the Vulnerable Software and Affected Versions: Vite versions prior to 3.2.11 Vite versions prior to 4.5.5 Vite versions prior to 5.2.14 Vite versions prior to 5.3.6 Vite versions prior to 5.4.6 Description: A DOM Clobbering vulnerability was discovered in Vite when building scripts to...

Vite Local Server Access Control Code Execution

The vulnerability of the Vite application development local server is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2024-31207

A flaw was found in the Node.js Vite package. When configuring the "server.fs.deny" server option to deny requests that include a pattern with directories such as /foo//, the requests were still being allowed. This can potentially expose files or directories containing sensitive information. Only...

CVE-2024-31207

Vite French word for "quick", pronounced /vit/, like "veet" is a frontend build tooling to improve the frontend development experience.server.fs.deny does not deny requests for patterns with directories. This vulnerability has been patched in versions 5.2.6, 5.1.7, 5.0.13, 4.5.3, 3.2.10 and 2.9.1...

CVE-2024-31207

CVE-2024-31207 (Vite) : The vulnerability is in Vite’s server.fs.deny logic, which does not deny requests for patterns containing directories. This could allow access to unintended files or paths during development. Affected versions include 2.9.18 and 3.2.10 up to 5.2.6, 5.1.7, 5.0.13, and 4.5.3...

@aklesky/vite-config (>=0.7.9, <=0.9.0), @angular-devkit/build-angular (>=17.1.0-next.0, <=17.2.3) +122 more potentially affected by CVE-2024-31207 via vite (>=5.0.0, <=5.0.12)

vite NPM version =5.0.0, =0.7.9, =17.1.0-next.0, =1.0.25-beta.0, =0.5.0, =0.22.0, =1.0.0-rc.12, =0.9.0, =4.20.4, =1.0.274, =0.40.2, =1.0.8, =0.0.7, =0.0.25 and more Source cves: CVE-2024-31207 Source advisory: MEND:CVE-2024-31207...