CVE-2025-62522 vite allows server.fs.deny bypass via backslash on Windows

Vite is a frontend tooling framework for JavaScript. In versions from 2.9.18 to before 3.0.0, 3.2.9 to before 4.0.0, 4.5.3 to before 5.0.0, 5.2.6 to before 5.4.21, 6.0.0 to before 6.4.1, 7.0.0 to before 7.0.8, and 7.1.0 to before 7.1.11, files denied by server.fs.deny were sent if the URL ended...

CVE-2025-62522 vite allows server.fs.deny bypass via backslash on Windows

Vite is a frontend tooling framework for JavaScript. In versions from 2.9.18 to before 3.0.0, 3.2.9 to before 4.0.0, 4.5.3 to before 5.0.0, 5.2.6 to before 5.4.21, 6.0.0 to before 6.4.1, 7.0.0 to before 7.0.8, and 7.1.0 to before 7.1.11, files denied by server.fs.deny were sent if the URL ended...

CVE-2025-62522

CVE-2025-62522 affects Vite dev server on Windows where URLs ending with a backslash can bypass server.fs.deny and serve files that should be blocked. Affected ranges: 2.9.18–3.0.0, 3.2.9–4.0.0, 4.5.3–5.0.0, 5.2.6–5.4.21, 6.0.0–6.4.1, 7.0.0–7.0.8, 7.1.0–7.1.11. Patch versions are 5.4.21, 6.4.1, 7...

@angular/build (>=20.1.0 <=20.2.0-next.2), @atomazing-org/super-app-host (>=0.0.4 <=0.0.8) +55 more potentially affected by CVE-2025-62522 via vite (>=7.0.0 <=7.0.6)

vite NPM version =7.0.0, =20.1.0, =0.0.4, =0.2.9, =1.190.0, =0.1.0, =0.0.1750946288791, =0.0.2, =0.0.7, =0.0.2, =0.0.1, =0.1.34, =0.1.35 and more Source cves: CVE-2025-62522 Source advisory: OSV:GHSA-93M4-6634-74Q7...

@angular/build (>=20.2.0-next.3 <=21.0.0-next.8), @brendonovich/solidjs__start (>=0.0.0 <=0.0.3) +8 more potentially affected by CVE-2025-62522 via vite (>=7.1.0 <=7.1.10)

vite NPM version =7.1.0, =20.2.0-next.3, =0.0.0, =2.20.3, =2.20.3, =0.0.12, =2.2.17, =2.2.17, =1.0.0, =2.20.3, =0.25.0-alpha.0, =0.25.0-alpha.1 Source cves: CVE-2025-62522 Source advisory: OSV:GHSA-93M4-6634-74Q7...

128981semzub (=1.0.1), 1food-menu (>=0.0.1 <=0.3.7) +5333 more potentially affected by CVE-2025-62522 via vite (>=2.9.18 <=5.4.20)

vite NPM version =2.9.18, =0.0.1, =1.0.0, =1.0.0, =2.0.3, =0.0.1, =0.0.1, =0.0.7, =4.0.61, =4.0.61, =4.0.61, =4.0.84 and more Source cves: CVE-2025-62522 Source advisory: OSV:GHSA-93M4-6634-74Q7...

@adhd/react-hooks (=2.2.1), @aklesky/vite-config (>=0.7.9 <=0.9.0) +466 more potentially affected by CVE-2025-62522 via vite (>=4.5.3 <=5.4.20)

vite NPM version =4.5.3, =0.7.9, =16.0.0, =16.0.0, =16.2.14, =18.0.0, =1.0.25-beta.0, =0.1.26, =0.1.25, =0.1.30, =0.1.32, =0.5.0, =0.5.5 - @avorati/strapi-plugin-preview =1.0.1 - @beardeddudes/strapi-types =0.1.1 and more Source cves: CVE-2025-62522 Source advisory: OSV:GHSA-93M4-6634-74Q7...

@angular-devkit/build-angular (>=17.3.12 <=17.3.15), @angular/build (>=18.1.0 <=19.0.7) +167 more potentially affected by CVE-2025-62522 via vite (>=5.2.6 <=5.4.20)

vite NPM version =5.2.6, =17.3.12, =18.1.0, =2.0.0-beta.3, =0.36.1, =0.1.2, =5.30.1, =0.9.1-next.19, =0.9.1-next.19, =0.9.1-next.19, =0.0.4, =0.21.1, =1.0.375, =1.0.409 - @cotofe/appkit-cdn =2.0.0 - @curatorjs/bridge =0.1.0 and more Source cves: CVE-2025-62522 Source advisory:...

@1771technologies/oneplay (>=0.0.1 <=0.0.6), @aicblock/cli (>=1.0.0 <=1.0.1) +170 more potentially affected by CVE-2025-62522 via vite (>=6.0.0 <=6.4.0)

vite NPM version =6.0.0, =0.0.1, =1.0.0, =1.0.0, =0.2.0, =4.25.19-patch.2, =19.1.0, =0.55.0, =0.21.2-4.1, =0.4.2, =0.1.10, =0.0.1, =4.0.0-canary.13656, =4.0.0-canary.13656, =4.0.0-canary.13657 and more Source cves: CVE-2025-62522 Source advisory: OSV:GHSA-93M4-6634-74Q7...

128981semzub (=1.0.1), 1food-menu (>=0.3.0 <=0.3.7) +3488 more potentially affected by CVE-2025-62522 via vite (>=4.0.0-beta.0 <=5.4.20)

vite NPM version =4.0.0-beta.0, =0.3.0, =1.0.0, =2.0.3, =0.0.1, =0.0.1, =0.0.7, =4.0.61, =4.0.61, =4.0.61, =4.0.61, =0.0.1, =0.0.3 and more Source cves: CVE-2025-62522 Source advisory: OSV:GHSA-93M4-6634-74Q7...

GHSA-93M4-6634-74Q7 vite allows server.fs.deny bypass via backslash on Windows

Summary Files denied by server.fs.deny were sent if the URL ended with \ when the dev server is running on Windows. Impact Only apps that match the following conditions are affected: - explicitly exposes the Vite dev server to the network using --host or server.host config option - running the de...

vite allows server.fs.deny bypass via backslash on Windows

Summary Files denied by server.fs.deny were sent if the URL ended with \ when the dev server is running on Windows. Impact Only apps that match the following conditions are affected: - explicitly exposes the Vite dev server to the network using --host or server.host config option - running the de...

PT-2025-42804

Name of the Vulnerable Software and Affected Versions Vite versions 2.9.18 through 3.0.0 Vite versions 3.2.9 through 4.0.0 Vite versions 4.5.3 through 5.0.0 Vite versions 5.2.6 through 5.4.21 Vite versions 6.0.0 through 6.4.1 Vite versions 7.0.0 through 7.0.8 Vite versions 7.1.0 through 7.1.11...

Vite 路径遍历漏洞

Vite is a new front-end build tool open-sourced by Vite. Vite suffers from a path traversal vulnerability that stems from a server.fs.deny rejected file being sent at the end of a URL in Windows environments, which could lead to information disclosure. The following versions are affected: version...

Malicious Package

Overview vite-ts-icon is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview vite-linting-js is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview vite-css-icon is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview vite-chunk-tools is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview vite-tsconfig-optimized is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

Malicious Package

Overview vite-react-chunker is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...