@aklesky/vite-config (1.0.0), @aminnairi/react-translate (>=0.2.0, <=1.0.0) +57 more potentially affected by CVE-2025-32395 via vite (>=6.0.0, <=6.0.11)

vite NPM version =6.0.0, =0.2.0, =4.25.19-patch.2, =19.1.0-next.0, =19.1.0-next.0, =6.0.0-beta.1, =0.0.0-sessions-20241122114539, =0.0.0-sessions-20241122114539, =0.0.0-sessions-20241122114539, =0.0.0-sessions-20241122114539, =0.4.2, =0.1.10, =0.0.1, =5.0.0-alpha.32, =5.0.0-alpha.38 and more Sour...

@aicblock/cli (>=1.0.0, <=1.0.1), @angular-devkit/build-angular (>=19.2.1, <=20.0.0-next.5) +45 more potentially affected by CVE-2025-32395 via vite (>=6.2.0, <=6.2.5)

vite NPM version =6.2.0, =1.0.0, =19.2.1, =19.2.1, =0.55.0, =0.21.2-4.1, =1.0.0, =1.0.410, =3.8.0, =1.47.0, =5.0.0-alpha.40, =1.0.0-next.1, =2.0.0-next.3 and more Source cves: CVE-2025-32395 Source advisory: OSV:GHSA-356W-63V5-8WF4...

CVE-2025-32395

Vite is a frontend tooling framework for javascript. Prior to 6.2.6, 6.1.5, 6.0.15, 5.4.18, and 4.5.13, the contents of arbitrary files can be returned to the browser if the dev server is running on Node or Bun. HTTP 1.1 spec RFC 9112 does not allow in request-target. Although an attacker can sen...

Information Exposure

Overview org.webjars.npm:vite is a Native-ESM powered web dev build tool Affected versions of this package are vulnerable to Information Exposure due to the handling of req.url which may contain unexpected characters such as . An attacker can access and retrieve the contents of arbitrary files by...

CVE-2025-32395 Vite has an `server.fs.deny` bypass with an invalid `request-target`

Vite is a frontend tooling framework for javascript. Prior to 6.2.6, 6.1.5, 6.0.15, 5.4.18, and 4.5.13, the contents of arbitrary files can be returned to the browser if the dev server is running on Node or Bun. HTTP 1.1 spec RFC 9112 does not allow in request-target. Although an attacker can sen...

CVE-2025-32395 Vite has an `server.fs.deny` bypass with an invalid `request-target`

Vite is a frontend tooling framework for javascript. Prior to 6.2.6, 6.1.5, 6.0.15, 5.4.18, and 4.5.13, the contents of arbitrary files can be returned to the browser if the dev server is running on Node or Bun. HTTP 1.1 spec RFC 9112 does not allow in request-target. Although an attacker can sen...

CVE-2025-32395 Vite has an `server.fs.deny` bypass with an invalid `request-target`

Vite is a frontend tooling framework for javascript. Prior to 6.2.6, 6.1.5, 6.0.15, 5.4.18, and 4.5.13, the contents of arbitrary files can be returned to the browser if the dev server is running on Node or Bun. HTTP 1.1 spec RFC 9112 does not allow in request-target. Although an attacker can sen...

CVE-2025-32395

CVE-2025-32395 affects Vite (frontend tooling for JavaScript). The vulnerability arises when a dev server is exposed to the network on Node/Bun (not Deno) and a request-target containing a # is processed, bypassing server.fs.deny due to req.url handling. Affected versions prior to 6.2.6, 6.1.5, 6...

PT-2025-15989 · Vite · Vite

Name of the Vulnerable Software and Affected Versions: Vite versions prior to 6.2.6 Vite versions prior to 6.1.5 Vite versions prior to 6.0.15 Vite versions prior to 5.4.18 Vite versions prior to 4.5.13 Description: Vite is a frontend tooling framework for javascript. The contents of arbitrary...

Vite 信息泄露漏洞

Vite is a new front-end builder tool open-sourced by Vite. An information disclosure vulnerability exists in Vite, which stems from the fact that the contents of an arbitrary file may be returned to the browser. The following versions are affected: versions prior to 6.2.6, 6.1.5, 6.0.15, 5.4.18,...

CVE-2025-32642

Cross-Site Request Forgery CSRF vulnerability in appsbd Vite Coupon vite-coupon allows Remote Code Inclusion.This issue affects Vite Coupon: from n/a through = 1.0.9...

CVE-2025-32642 WordPress Vite Coupon plugin <= 1.0.9 - CSRF to Remote Code Execution (RCE) vulnerability

Cross-Site Request Forgery CSRF vulnerability in appsbd Vite Coupon vite-coupon allows Remote Code Inclusion.This issue affects Vite Coupon: from n/a through = 1.0.9...

CVE-2025-32642 WordPress Vite Coupon plugin <= 1.0.9 - CSRF to Remote Code Execution (RCE) vulnerability

Cross-Site Request Forgery CSRF vulnerability in appsbd Vite Coupon vite-coupon allows Remote Code Inclusion.This issue affects Vite Coupon: from n/a through = 1.0.9...

WordPress Vite Coupon plugin <= 1.0.9 - CSRF to Remote Code Execution (RCE) vulnerability

CSRF to Remote Code Execution RCE vulnerability discovered by stealthcopter in WordPress Plugin Vite Coupon versions = 1.0.9...

Malicious code in vite-plugin-monorepo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cffc6b2ef3ee7169eb637677097e46e1f9c980cd6fd606d1b521830c2a8cc92b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3203 Malicious code in vite-plugin-monorepo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cffc6b2ef3ee7169eb637677097e46e1f9c980cd6fd606d1b521830c2a8cc92b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Unauthorized File Exposure

Vite is vulnerable to Unauthorized File Exposure. The vulnerability is due to improper exposure of non-allowed files through the ?inline or ?raw?import methods when the Vite dev server is explicitly exposed to the network using --host or the server.host config option, allows unauthorized access t...

WordPress plugin Vite Coupon 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request...

PT-2025-15810 · Unknown · Vite Coupon

Name of the Vulnerable Software and Affected Versions: Vite Coupon versions 1.0.7 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Remote Code Inclusion. This means an attacker can potentially execute malicious code on a remote server, which could...

CVE-2025-31486

Vite is a frontend tooling framework for javascript. The contents of arbitrary files can be returned to the browser. By adding ?.svg with ?.wasm?init or with sec-fetch-dest: script header, the server.fs.deny restriction was able to bypass. This bypass is only possible if the file is smaller than...