Advisories for Npm/Vite package

The contents of files that are specified by server.fs.deny can be returned to the browser. This is the same as https://github.com/vitejs/vite/security/advisories/GHSA-v2wj-q39q-566r.

The first 4 bytes of files outside of server.fs setting can be returned to the browser by a request containing ?vite-wasm-instance.

The content of files outside server.fs setting can be returned to the browser if the project imports a file path concatenated with the root. For example, if the project references <path-to-project-root>/etc/hosts, the content of /etc/hosts was possible to be returned. The content of files outside the server.fs.allow option can be returned to the browser when a project imports a file whose root-relative path matches an absolute path on the host. …

When accessing a malicious site while a dev server using Vite is running, that site was able to load scripts in a page served by the dev server.

launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed.

launch-editor forwarded file paths directly to editors without sanitization. If a path resembles a CLI flag, editors like Vim may interpret it as a command, potentially causing unintended file overwrites or command execution.

launch-editor checked fs.existsSync(fileName) before passing a supplied path to an editor command. On Windows, an attacker can bypass this check with a crafted path ending in \..:line:column. This removes the requirement that the attacker be able to place a file with a malicious filename.

The contents of files that are specified by server.fs.deny can be returned to the browser on Windows.

The launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the user’s NTLMv2 password hash to be leaked to an attacker-controlled SMB server. This can result in credential compromise through offline hash cracking.

Due to the insufficient sanitization of the file argument in the launchEditor, an attacker can execute arbitrary commands on Windows by supplying a filename that contains special characters.

The contents of files that are specified by server.fs.deny can be returned to the browser.

The contents of files that are specified by server.fs.deny can be returned to the browser.

Any files ending with .map even out side the project can be returned to the browser.

Any files ending with .map even out side the project can be returned to the browser.

server.fs check was not enforced to the fetchModule method that is exposed in Vite dev server's WebSocket.

server.fs check was not enforced to the fetchModule method that is exposed in Vite dev server's WebSocket.

Files denied by server.fs.deny were sent if the URL ended with \ when the dev server is running on Windows.

Any HTML files on the machine were served regardless of the server.fs settings.

Files starting with the same name with the public directory were served bypassing the server.fs settings.

The contents of files in the project root that are denied by a file matching pattern can be returned to the browser.

This advisory duplicates another.

The contents of arbitrary files can be returned to the browser if the dev server is running on Node or Bun.

The contents of arbitrary files can be returned to the browser.

The contents of arbitrary files can be returned to the browser.

The contents of arbitrary files can be returned to the browser.

Vite allowed any websites to send any requests to the development server and read the response due to default CORS settings and lack of validation on the Origin header for WebSocket connections. [!WARNING] This vulnerability even applies to users that only run the Vite dev server on the local machine and does not expose the dev server to the network.

The contents of arbitrary files can be returned to the browser.

We discovered a DOM Clobbering vulnerability in Vite when building scripts to cjs/iife/umd output format. The DOM Clobbering gadget in the module can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an img tag with an unsanitized name attribute) are present. Note that, we have identified similar security issues in Webpack: https://github.com/webpack/webpack/security/advisories/GHSA-4vvj-4cpr-p986

Vite dev server option server.fs.deny did not deny requests for patterns with directories. An example of such a pattern is /foo/**/*.

Vite is a frontend tooling framework for javascript. The Vite dev server option server.fs.deny can be bypassed on case-insensitive file systems using case-augmented versions of filenames. Notably this affects servers hosted on Windows. This bypass is similar to CVE-2023-34092 – with surface area reduced to hosts having case-insensitive filesystems. Since picomatch defaults to case-sensitive glob matching, but the file server does not discriminate; a block list bypass is possible. By …

Vite is a website frontend framework. When Vite's HTML transformation is invoked manually via server.transformIndexHtml, the original request URL is passed in unmodified, and the html being transformed contains inline module scripts (<script type="module">…</script>), it is possible to inject arbitrary HTML into the transformed output by supplying a malicious URL query string to server.transformIndexHtml. Only apps using appType: 'custom' and using the default Vite HTML middleware are affected. The HTML …

Vite provides frontend tooling. Prior to versions 2.9.16, 3.2.7, 4.0.5, 4.1.5, 4.2.3, and 4.3.9, Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//) allows any unauthenticated user to read file from the Vite root-path of the application including the default fs.deny settings (['.env', '.env.', '.{crt,pem}']). Only users explicitly exposing the Vite dev server to the network (using –host or server.host config option) are affected, and only files in …

Vite before v2.9.13 was discovered to allow attackers to perform a directory traversal via a crafted URL to the victim's service.