PT-2025-12667

Name of the Vulnerable Software and Affected Versions: Vite versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. Description: Vite is susceptible to an arbitrary file read vulnerability due to improper handling of special characters in the @fs mechanism. By appending ?raw?? or ?import&raw?...

PT-2025-13476 · Vite · Vite

Name of the Vulnerable Software and Affected Versions: Vite affected versions not specified Description: The issue is related to the transformMiddleware function of the @fs mechanism in Vite's local development server, which incorrectly handles special characters in input data. This can be...

Malicious code in dev-debugger-vite (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 836268a49761be0bbcd6dd89283cbaceea33d8ddf28b8fec0ca5337c318eba52 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2372 Malicious code in dev-debugger-vite (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 836268a49761be0bbcd6dd89283cbaceea33d8ddf28b8fec0ca5337c318eba52 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1561 Malicious code in vite_ruby_monorepo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5f016bbad97a0f6e120d5540fe2632278fddf3420077cdcfd4baba37ff8b9580 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The vulnerability of the CORS mechanism of the Vite application development local server allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the CORS mechanism of the Vite application development local server is related to the lack of origin verification in WebSockets. Exploiting this vulnerability allows an attacker operating remotely to gain unauthorized access to protected information by sending specially craft...

CVE-2024-23331

Vite is a frontend tooling framework for javascript. The Vite dev server option server.fs.deny can be bypassed on case-insensitive file systems using case-augmented versions of filenames. Notably this affects servers hosted on Windows. This bypass is similar to CVE-2023-34092 -- with surface area...

Vitest 安全漏洞

Vitest is a Vite-powered next-generation testing framework open-sourced by Vitest. A security vulnerability exists in Vitest that stems from vulnerability to arbitrary remote code execution attacks...

Malicious code in vite-paypal (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 667d1b093499f31a7533aa131e6a6a7833a64bf1100de5a7b1369f07b30ac93b Any computer that has this package installed or running should be considered...

MAL-2025-717 Malicious code in vite-paypal (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 667d1b093499f31a7533aa131e6a6a7833a64bf1100de5a7b1369f07b30ac93b Any computer that has this package installed or running should be considered...

@andor83/mother-may-i (>=1.0.1, <=1.0.10), @bloggrify/bento (>=0.9.1, <=1.0.0) +27 more potentially affected by CVE-2025-24360 via @nuxt/vite-builder (>=3.8.1, <=3.15.2)

@nuxt/vite-builder NPM version =3.8.1, =1.0.1, =0.9.1, =1.1.1, =1.0.1-alpha1, =1.1.0, =0.3.14, =9.8.3-rc.1, =1.12.0-rc.5, =1.0.1-alpha.1024, =3.2.0, =0.2.3, =0.2.0-alpha.2, =0.2.0 - @xizs/nuxt-base 0.0.2 and more Source cves: CVE-2025-24360 Source advisory: OSV:GHSA-2452-6XJ8-JH47...

Opening a malicious website while running a Nuxt dev server could allow read-only access to code

Summary Nuxt allows any websites to send any requests to the development server and read the response due to default CORS settings. Details While Vite patched the default CORS settings to fix https://github.com/vitejs/vite/security/advisories/GHSA-vg6x-rcgg-rjx6, nuxt uses its own CORS handler by...

CVE-2025-24360 Opening a malicious website while running a Nuxt dev server could allow read-only access to code

Nuxt is an open-source web development framework for Vue.js. Starting in version 3.8.1 and prior to version 3.15.3, Nuxt allows any websites to send any requests to the development server and read the response due to default CORS settings. Users with the default server.cors option using Vite...

@aklesky/vite-config (1.0.0), @aminnairi/react-translate (>=0.2.0, <=1.0.0) +49 more potentially affected by CVE-2025-24010 +1 more via vite (>=6.0.0, <=6.0.8)

vite NPM version =6.0.0, =0.2.0, =19.1.0-next.0, =19.1.0-next.0, =6.0.0-beta.1, =0.0.0-sessions-20241122114539, =0.0.0-sessions-20241122114539, =0.0.0-sessions-20241122114539, =0.0.0-sessions-20241122114539, =0.4.2, =0.1.10, =0.0.1, =5.0.0-alpha.32, =2.9.2, =2.9.2, =2.10.3 and more Source cves:...

@adhd/react-hooks (2.2.1), @adhd/ui-react-base-hooks (>=2.2.1, <=2.3.1) +434 more potentially affected by CVE-2025-24010 +1 more via vite (>=5.0.0, <=5.4.11)

vite NPM version =5.0.0, =2.2.1, =0.0.1, =0.7.9, =4.23.1-prerelease.0, =17.1.0-next.0, =18.0.0-next.3, =1.0.25-beta.0, =0.0.1-alpha.0, =0.5.0, =2.0.0-beta.0, =3.0.0-beta.1 and more Source cves: CVE-2025-24010, CVE-2025-24360 Source advisory: OSV:GHSA-VG6X-RCGG-RJX6...

@4399ywkf/bundler-vite (>=4.0.61, <=4.0.84), @4399ywkf/js (>=4.0.61, <=4.0.84) +509 more potentially affected by CVE-2025-24010 +1 more via vite (>=4.0.0, <=4.5.5)

vite NPM version =4.0.0, =4.0.61, =4.0.61, =4.0.61, =4.0.61, =0.0.1, =0.0.0, =0.0.1, =0.0.3, =0.0.1, =0.0.1, =0.0.1, =3.3.9-patch.1, =3.3.9-patch.2 and more Source cves: CVE-2025-24010, CVE-2025-24360 Source advisory: OSV:GHSA-VG6X-RCGG-RJX6...

Websites were able to send any requests to the development server and read the response in vite

Summary Vite allowed any websites to send any requests to the development server and read the response due to default CORS settings and lack of validation on the Origin header for WebSocket connections. !WARNING This vulnerability even applies to users that only run the Vite dev server on the loc...

GHSA-VG6X-RCGG-RJX6 Websites were able to send any requests to the development server and read the response in vite

Summary Vite allowed any websites to send any requests to the development server and read the response due to default CORS settings and lack of validation on the Origin header for WebSocket connections. !WARNING This vulnerability even applies to users that only run the Vite dev server on the loc...

PT-2025-5342 · Vite +1 · Vite +1

Name of the Vulnerable Software and Affected Versions: Nuxt versions 3.8.1 through 3.15.2 Description: The issue arises due to default CORS settings in Nuxt, allowing any website to send requests to the development server and read the response. This can lead to source code theft by malicious...

CVE-2025-24010

Vite is a frontend tooling framework for javascript. Vite allowed any websites to send any requests to the development server and read the response due to default CORS settings and lack of validation on the Origin header for WebSocket connections. This vulnerability is fixed in 6.0.9, 5.4.12, and...