Vite's server.fs.deny bypassed with /. for files under project root

Summary The contents of files in the project root that are denied by a file matching pattern can be returned to the browser. Impact Only apps explicitly exposing the Vite dev server to the network using --host or server.host config option are affected. Only files that are under project root and a...

GHSA-859W-5945-R5V3 Vite's server.fs.deny bypassed with /. for files under project root

Summary The contents of files in the project root that are denied by a file matching pattern can be returned to the browser. Impact Only apps explicitly exposing the Vite dev server to the network using --host or server.host config option are affected. Only files that are under project root and a...

Directory Traversal

Overview org.webjars.npm:vite is a Native-ESM powered web dev build tool Affected versions of this package are vulnerable to Directory Traversal through the server.fs.deny configuration due to improper input sanitization. An attacker can bypass server.fs.deny with /. for files under project root...

@aicblock/cli (>=1.0.0, <=1.0.1), @aklesky/vite-config (1.0.1) +47 more potentially affected by CVE-2025-46565 via vite (>=6.2.0, <=6.2.6)

vite NPM version =6.2.0, =1.0.0, =19.2.1, =19.2.1, =0.55.0, =0.21.2-4.1, =1.0.0, =1.0.410, =3.8.0, =1.47.0, =5.0.0-alpha.40, =5.0.0-alpha.45 - @darkyzhou-powered/waku 0.21.24 and more Source cves: CVE-2025-46565 Source advisory: OSV:GHSA-859W-5945-R5V3...

@aklesky/vite-config (1.0.0), @aminnairi/react-translate (>=0.2.0, <=1.0.0) +92 more potentially affected by CVE-2025-46565 via vite (>=6.0.0, <=6.1.4)

vite NPM version =6.0.0, =0.2.0, =4.25.19-patch.2, =19.1.0-next.0, =19.1.0-next.0, =6.0.0-beta.1, =0.0.0-sessions-20241122114539, =0.0.0-sessions-20241122114539, =0.0.0-sessions-20241122114539, =0.0.0-sessions-20241122114539, =0.4.2, =0.1.10, =0.0.1, =5.0.0-alpha.32, =5.0.0-alpha.39 and more Sour...

PT-2025-18682

Name of the Vulnerable Software and Affected Versions Vite versions prior to 6.3.4 Vite versions prior to 6.2.7 Vite versions prior to 6.1.6 Vite versions prior to 5.4.19 Vite versions prior to 4.5.14 Description The issue concerns Vite, a frontend tooling framework for JavaScript. In affected...

VulnCheck KEV: CVE-2025-30208

Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. @fs denies access to files outside of Vite serving allow list. Adding ?raw?? or ?import&raw?? to the URL bypasses this limitation and returns the file content...

Exploit for CVE-2025-30208

CVE-2025-30208 & CVE-2025-31125 & CVE-2025-31486 1. Overvie...

Arbitrary File Disclosure

Vite is vulnerable to Arbitrary File Disclosure. The vulnerability is due to incorrect assumptions about the presence of in req.url, which is permitted by some runtimes Node, Bun despite being invalid per HTTP specs, allowing attackers to bypass file system access restrictions using path traversa...

Exploit for CVE-2025-30208

CVE-2025-30208-template CVE-2025-30208 vite file...

Vite < 4.5.10 / 5.0.x < 5.4.15 / 6.0.x < 6.0.12 / 6.1.x < 6.1.2 / 6.2.x < 6.2.3 Arbitrary File Read

Vite version prior to 4.5.10, 5.0.x prior to 5.4.15, 6.0.x prior to 6.0.12, 6.1.x prior to 6.1.2 or 6.2.x prior to 6.2.3 are affected by a vulnerability allowing unauthenticated remote attackers to read arbitrary files on the affected host when the app is exposing the Vite dev server to the...

Vite < 4.5.13 / 5.0.x < 5.4.18 / 6.0.x < 6.0.15 / 6.1.x < 6.1.5 / 6.2.x < 6.2.6 Arbitrary File Read

Vite version prior to 4.5.13, 5.0.x prior to 5.4.18, 6.0.x prior to 6.0.15, 6.1.x prior to 6.1.5 or 6.2.x prior to 6.2.6 are affected by a vulnerability allowing unauthenticated remote attackers to read arbitrary files on the affected host when the app is exposing the Vite dev server to the...

Security Bulletin: A vulnerability in vite affects IBM Robotic Process Automation which could result in incorrect validation for WebSocket Connections (CVE-2025-24010).

Summary A vulnerability in vite affects IBM Robotic Process Automation which could result in incorrect validation for WebSocket Connections CVE-2025-24010. Vite is used by IBM Robotic Process Automation as part of it's user interface. This bulletin identifies the fixes required to resolve the...

SUSE CVE-2025-32395

Vite is a frontend tooling framework for javascript. Prior to 6.2.6, 6.1.5, 6.0.15, 5.4.18, and 4.5.13, the contents of arbitrary files can be returned to the browser if the dev server is running on Node or Bun. HTTP 1.1 spec RFC 9112 does not allow in request-target. Although an attacker can sen...

CVE-2025-32642

Cross-Site Request Forgery CSRF vulnerability in appsbd Vite Coupon vite-coupon allows Remote Code Inclusion.This issue affects Vite Coupon: from n/a through = 1.0.9...

@4399ywkf/bundler-vite (>=4.0.61, <=4.0.84), @4399ywkf/js (>=4.0.61, <=4.0.84) +511 more potentially affected by CVE-2025-32395 via vite (>=4.0.0, <=4.5.11)

vite NPM version =4.0.0, =4.0.61, =4.0.61, =4.0.61, =4.0.61, =0.0.1, =0.0.0, =0.0.1, =0.0.3, =0.0.1, =0.0.1, =0.0.1, =3.3.9-patch.1, =3.3.9-patch.2 and more Source cves: CVE-2025-32395 Source advisory: OSV:GHSA-356W-63V5-8WF4...

@angular-devkit/build-angular (>=19.2.0-next.2, <=19.2.0), @angular/build (>=19.2.0-next.2, <=19.2.0) +41 more potentially affected by CVE-2025-32395 via vite (>=6.1.0, <=6.1.4)

vite NPM version =6.1.0, =19.2.0-next.2, =19.2.0-next.2, =1.0.7, =2.12.0, =2.12.0, =11.24.0, =0.0.1739797164641, =1.0.0, =0.0.0-experimental-989cf02-20250217-d62ba1cb, =0.0.0-experimental-0580205-20250209-2be35102, =0.0.0-snapshot-08bd566ea55152626f488c12d32ebce7e35b812d,...

GHSA-356W-63V5-8WF4 Vite has an `server.fs.deny` bypass with an invalid `request-target`

Summary The contents of arbitrary files can be returned to the browser if the dev server is running on Node or Bun. Impact Only apps with the following conditions are affected. - explicitly exposing the Vite dev server to the network using --host or server.host config option - running the Vite de...

@adhd/react-hooks (2.2.1), @adhd/ui-react-base-hooks (>=2.2.1, <=2.3.1) +446 more potentially affected by CVE-2025-32395 via vite (>=5.0.0, <=5.4.17)

vite NPM version =5.0.0, =2.2.1, =0.0.1, =0.7.9, =4.23.1-prerelease.0, =17.1.0-next.0, =18.0.0-next.3, =1.0.25-beta.0, =0.0.1-alpha.0, =0.5.0, =2.0.0-beta.0, =3.0.0-beta.1 and more Source cves: CVE-2025-32395 Source advisory: OSV:GHSA-356W-63V5-8WF4...

Vite has an `server.fs.deny` bypass with an invalid `request-target`

Summary The contents of arbitrary files can be returned to the browser if the dev server is running on Node or Bun. Impact Only apps with the following conditions are affected. - explicitly exposing the Vite dev server to the network using --host or server.host config option - running the Vite de...