CVE-2023-46115

Tauri is a framework for building binaries for all major desktop platforms. This advisory is not describing a vulnerability in the Tauri code base itself but a commonly used misconfiguration which could lead to leaking of the private key and updater key password into bundled Tauri applications...

Code injection

Tauri is a framework for building binaries for all major desktop platforms. This advisory is not describing a vulnerability in the Tauri code base itself but a commonly used misconfiguration which could lead to leaking of the private key and updater key password into bundled Tauri applications...

CVE-2023-46115

Technical details (affected versions, vulnerable components, exploit specifics) are not provided in the supplied documents. Monitor for updates from the vendors and CVE registries.

CVE-2023-46115 Updater Private Keys Possibly Leaked via Vite Environment Variables in tauri-cli

Tauri is a framework for building binaries for all major desktop platforms. This advisory is not describing a vulnerability in the Tauri code base itself but a commonly used misconfiguration which could lead to leaking of the private key and updater key password into bundled Tauri applications...

CVE-2023-46115 Updater Private Keys Possibly Leaked via Vite Environment Variables in tauri-cli

Tauri is a framework for building binaries for all major desktop platforms. This advisory is not describing a vulnerability in the Tauri code base itself but a commonly used misconfiguration which could lead to leaking of the private key and updater key password into bundled Tauri applications...

CVE-2023-46115 Updater Private Keys Possibly Leaked via Vite Environment Variables in tauri-cli

Tauri is a framework for building binaries for all major desktop platforms. This advisory is not describing a vulnerability in the Tauri code base itself but a commonly used misconfiguration which could lead to leaking of the private key and updater key password into bundled Tauri applications...

urdfjsx (>=0.1.3 <=0.1.4), vite-plugin-vue-css-modules (>=3.1.4 <=4.0.1) potentially affected by CVE-2023-45133 via @babel/traverse (>=8.0.0-alpha.11 <=8.0.0-alpha.2)

@babel/traverse NPM version =8.0.0-alpha.11, =0.1.3, =3.1.4, =4.0.1 Source cves: CVE-2023-45133 Source advisory: OSV:GHSA-67HX-6X53-JW92...

@cfpreview/pages-e2e-test-runner-cli (>=0.0.9 <=0.0.25), @cloudflare/vite-plugin (>=0.0.0-0a9a26099 <=0.0.0-fec45ed61) +5 more potentially affected by CVE-2023-3348 via wrangler (>=0.0.0-a18155fb8 <=2.0.23)

wrangler NPM version =0.0.0-a18155fb8, =0.0.9, =0.0.0-0a9a26099, =0.0.1, =0.0.84-test.20250522015638, =1.0.0, =2.1.7 Source cves: CVE-2023-3348 Source advisory: OSV:GHSA-8C93-4HCH-XGXP...

@aem-vite/import-rewriter (>=5.0.1 <=6.0.1), @aem-vite/vite-aem-plugin (>=1.0.0 <=2.3.1) +220 more potentially affected by CVE-2023-34092 via vite (>=0.14.4 <=2.9.15)

vite NPM version =0.14.4, =5.0.1, =1.0.0, =3.0.0-beta.5, =3.0.0-beta.2, =0.0.1, =0.10.0, =1.0.16, =1.1.0-next.4, =0.0.0-experimental-17c6886-20220324, =0.0.0-canary-20220428124037, =0.1.5, =0.0.11, =0.0.12, =0.0.1, =0.1.5, =0.1.11 and more Source cves: CVE-2023-34092 Source advisory:...

@alioth_91/alita (>=3.3.9-patch.1 <=3.3.9-patch.2), @alitajs/vue-i18n (>=0.0.7 <=0.0.8) +98 more potentially affected by CVE-2023-34092 via vite (>=4.3.0 <=4.3.8)

vite NPM version =4.3.0, =3.3.9-patch.1, =0.0.7, =0.0.7, =0.0.7, =0.0.7, =0.0.7, =0.0.1, =0.0.1, =16.0.0, =2.0.0, =12.0.0, =0.0.0-canary-20230426131112, =0.0.1, =0.0.12 - @deconz-community/directus-extension-ddf-store =0.1.0 and more Source cves: CVE-2023-34092 Source advisory:...

Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)

The issue involves a security vulnerability in Vite where the server options can be bypassed using a double forward slash //. This vulnerability poses a potential security risk as it can allow unauthorized access to sensitive directories and files. Steps to Fix. Update Vite: Ensure that you are...

@alexaegis/setup-editorconfig (>=0.0.3 <=0.0.5), @alexaegis/setup-vite (>=0.0.3 <=0.0.5) +55 more potentially affected by CVE-2023-34092 via vite (>=4.2.0 <=4.2.2)

vite NPM version =4.2.0, =0.0.3, =0.0.3, =0.0.3, =0.0.3, =0.0.3, =0.0.5, =0.0.5, =0.0.5, =0.0.5, =16.0.0-next.7, =1.0.0-beta.0, =0.0.0-canary-20230317112045, =22.0.0 - @emhamzahazeen/config-vite =1.0.0 and more Source cves: CVE-2023-34092 Source advisory: OSV:GHSA-353F-5XF4-QW67...

@4399ywkf/bundler-vite (>=4.0.61 <=4.0.84), @4399ywkf/js (>=4.0.61 <=4.0.84) +46 more potentially affected by CVE-2023-34092 via vite (>=4.1.0 <=4.1.4)

vite NPM version =4.1.0, =4.0.61, =4.0.61, =4.0.61, =4.0.61, =0.0.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.0.0-canary-20230215113341, =4.6.2, =11.6.5, =5.3.8, =5.0.0, =5.0.1 and more Source cves: CVE-2023-34092 Source advisory: OSV:GHSA-353F-5XF4-QW67...

@brewer/beerui (>=1.1.9 <=1.1.16-beta-8), @catalysisdev/build (=0.8.0) +32 more potentially affected by CVE-2023-34092 via vite (>=4.0.0 <=4.0.4)

vite NPM version =4.0.0, =1.1.9, =0.0.0-canary-20221223101943, =5.3.4, =0.5.6, =0.7.2-alpha.0 and more Source cves: CVE-2023-34092 Source advisory: OSV:GHSA-353F-5XF4-QW67...

1food-menu (>=0.0.1 <=0.2.3), 7qb-cli (=2.0.0) +1096 more potentially affected by CVE-2023-34092 via vite (>=3.0.2 <=3.2.5)

vite NPM version =3.0.2, =0.0.1, =2.0.0, =1.0.1, =1.0.2, =0.0.42-beta1, =0.0.0, =0.0.5, =1.2.56-alpha.0, =1.3.4, =1.0.0, =1.0.22, =1.0.7, =1.2.60 and more Source cves: CVE-2023-34092 Source advisory: OSV:GHSA-353F-5XF4-QW67...

GHSA-353F-5XF4-QW67 Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)

The issue involves a security vulnerability in Vite where the server options can be bypassed using a double forward slash //. This vulnerability poses a potential security risk as it can allow unauthorized access to sensitive directories and files. Steps to Fix. Update Vite: Ensure that you are...

CVE-2023-34092

Vite provides frontend tooling. Prior to versions 2.9.16, 3.2.7, 4.0.5, 4.1.5, 4.2.3, and 4.3.9, Vite Server Options server.fs.deny can be bypassed using double forward-slash // allows any unauthenticated user to read file from the Vite root-path of the application including the default fs.deny...

Design/Logic Flaw

Vite provides frontend tooling. Prior to versions 2.9.16, 3.2.7, 4.0.5, 4.1.5, 4.2.3, and 4.3.9, Vite Server Options server.fs.deny can be bypassed using double forward-slash // allows any unauthenticated user to read file from the Vite root-path of the application including the default fs.deny...

CVE-2023-34092 Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//)

Vite provides frontend tooling. Prior to versions 2.9.16, 3.2.7, 4.0.5, 4.1.5, 4.2.3, and 4.3.9, Vite Server Options server.fs.deny can be bypassed using double forward-slash // allows any unauthenticated user to read file from the Vite root-path of the application including the default fs.deny...

CVE-2023-34092

Vite core fix for CVE-2023-34092 (also echoed in related CVEs) describes a bypass of server.fs.deny via double-slash to read files from the Vite project root when the dev server is exposed (–host or server.host). Affected versions before the fixes include: 2.9.16, 3.2.7, 4.0.5, 4.1.5, 4.2.3, and ...