Vite
Monthly
Path-validation bypass in launch-editor before 2.14.2 on Windows allows unauthenticated remote attackers to pass a crafted file:line:column argument that resolves to an existing parent directory and slips past the library's filename-existence check. The bypass does not by itself execute code; it becomes an OS command injection risk only when chained with the separately described Windows percent-expansion flaw, and exploitation requires user interaction plus a reachable launch-editor-middleware endpoint such as a Vite dev server. No public exploit was identified at time of analysis, and the issue is fixed in 2.14.2.
Vite is a frontend tooling framework for javascript. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required. Actively exploited in the wild (cisa kev) and public exploit code available.
Information disclosure in the Vite development server 6.4.4 lets a network attacker retrieve files that server.fs.deny is supposed to block - including .env files and certificates - by appending loader query parameters such as ?raw, ?import&raw, or ?import&url&inline to the denied path, receiving the contents with HTTP 200. Exploitation requires that the dev server was explicitly exposed to the network via --host or server.host, that the sensitive file sits inside a server.fs.allow directory, and that it matches a server.fs.deny pattern; default local-only development is not affected, and the impact is limited to disclosure (no code execution or file modification). The vendor rates this CVSS 4.0 base 6.9, the flaw is fixed in Vite 6.4.5, and no public exploit code was identified at time of analysis.
A path-traversal information-disclosure flaw in Vite's development server (versions 8.2.0 through 8.2.3 and 8.3.0 through 8.3.2) lets a remote requester read the first 4 bytes of any file on the host filesystem - including files deliberately excluded from server.fs allowed roots, such as .env secrets and private keys - by appending a ?vite-wasm-instance query string to the request path. The internal Wasm plugin's load hook strips the query, reads the target path directly from disk without applying server.fs checks, then fails WebAssembly parsing and leaks the file's leading bytes in the resulting Node/Deno error message. Exploitation requires a network-reachable dev server (localhost-bound by default, so exposure via 0.0.0.0 binding, proxying, or a shared network is a precondition); no public exploit code exists in the provided data and CISA KEV does not list it, while the assessed impact is limited confidentiality loss given only 4 bytes leak per request.
Vite development servers can be induced to serve a single file from outside the project root after import analysis records a root-relative browser URL, rather than the cleaned resolved module identifier, in the internal safeModulePaths trust list. Only non-Windows hosts running a network-accessible dev server (not a production build) are affected, and only when server.fs.deny does not already block the target file; because the colliding path must correspond to a project-relative URL authorized by the application graph, arbitrary path traversal is not achievable and impact is limited to read disclosure with no integrity or availability effect. Exploitation requires the coincidence of an imported project file whose URL matches an absolute host path plus attacker access to the exposed dev server, which the independent assessment scores as higher complexity (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N); no public exploit code was identified at time of analysis.
A crafted request URL containing leading double slashes can cause the Vite development server to emit a protocol-relative module URL in transformed HTML, so a victim's browser fetches and executes an attacker-hosted module inside the Vite-served page. Only applications built on custom middleware that forwards an unchanged browser request URL into server.transformIndexHtml are affected, and the exposure is limited to the dev server rather than production builds; the impacted code paths exist in Vite before 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; exploitation additionally requires a victim developer to actively load the malicious page, which keeps real-world risk LOW.
Argument injection in launch-editor (prior to 2.14.2), the Node.js 'open file in editor' helper shipped with Vite and vite-plus, allows an unauthenticated attacker who can place a file whose name begins with '+' or '-' into the project working directory to have that name interpreted as a command-line flag by the selected editor. When the reachable editor is Vim/gVim, MacVim, Emacs/Emacsclient, or Notepad++ with a plugin exposing dangerous operations, and the path stays relative (or is converted to a relative WSL path), this can lead to unintended file overwrite or arbitrary command execution in the developer's context. Exploitation is heavily preconditioned - the malicious filesystem entry must already exist, a vulnerable editor must be the configured one, and VS Code or absolute-path invocations are unaffected - so per the independent assessment it is rated AC:H with limited (low) confidentiality, integrity, and availability impact rather than a straightforward RCE; no public exploit code has been identified at time of analysis.
OS command injection on Windows in the launch-editor npm package before 2.14.2 lets remote attackers who can influence an environment variable value or a file path containing '%' trigger cmd.exe variable expansion and execute arbitrary commands when the open-in-editor feature is invoked. The flaw is rated medium severity (CVSS 4.0 base 6.3; CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) and is limited to Windows developer workstations using Vite or Vite Plus dev-server tooling; no public exploit identified at time of analysis.
launch-editor allows users to open files with line numbers in editor from Node.js. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Arbitrary remote code execution in @vitejs/plugin-rsc 0.5.5 and earlier lets unauthenticated network attackers run JavaScript with Node.js privileges on a running Vite development server that uses React Server Components and exposes server-function endpoints. The flaw lives in the development-mode dynamic import path used by loadServerAction, decodeReply, and decodeAction, which accepts attacker-controlled references (including data: URL modules) supplied via the x-rsc-action header and request body; a public proof-of-concept exploit exists in the GitHub Security Advisory, though EPSS rates near-term exploitation likelihood low at 0.81% (56th percentile) and it is not in CISA KEV. Impact is confined to development servers - production builds are unaffected - but risk rises sharply when developers run 'vite --host', exposing the port on all network interfaces.
Vite is a frontend tooling framework for JavaScript. Rated low severity (CVSS 2.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Vite is a frontend tooling framework for JavaScript. Rated low severity (CVSS 2.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Vite is a frontend tooling framework for javascript. Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and EPSS exploitation probability 89.0%.
Vite is a frontend tooling framework for javascript. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Vite is a frontend tooling framework for javascript. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Vite is a website frontend framework. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Vite provides frontend tooling. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Vitejs Vite before v2.9.13 was discovered to allow attackers to perform a directory traversal via a crafted URL to the victim's service. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Path-validation bypass in launch-editor before 2.14.2 on Windows allows unauthenticated remote attackers to pass a crafted file:line:column argument that resolves to an existing parent directory and slips past the library's filename-existence check. The bypass does not by itself execute code; it becomes an OS command injection risk only when chained with the separately described Windows percent-expansion flaw, and exploitation requires user interaction plus a reachable launch-editor-middleware endpoint such as a Vite dev server. No public exploit was identified at time of analysis, and the issue is fixed in 2.14.2.
Vite is a frontend tooling framework for javascript. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required. Actively exploited in the wild (cisa kev) and public exploit code available.
Information disclosure in the Vite development server 6.4.4 lets a network attacker retrieve files that server.fs.deny is supposed to block - including .env files and certificates - by appending loader query parameters such as ?raw, ?import&raw, or ?import&url&inline to the denied path, receiving the contents with HTTP 200. Exploitation requires that the dev server was explicitly exposed to the network via --host or server.host, that the sensitive file sits inside a server.fs.allow directory, and that it matches a server.fs.deny pattern; default local-only development is not affected, and the impact is limited to disclosure (no code execution or file modification). The vendor rates this CVSS 4.0 base 6.9, the flaw is fixed in Vite 6.4.5, and no public exploit code was identified at time of analysis.
A path-traversal information-disclosure flaw in Vite's development server (versions 8.2.0 through 8.2.3 and 8.3.0 through 8.3.2) lets a remote requester read the first 4 bytes of any file on the host filesystem - including files deliberately excluded from server.fs allowed roots, such as .env secrets and private keys - by appending a ?vite-wasm-instance query string to the request path. The internal Wasm plugin's load hook strips the query, reads the target path directly from disk without applying server.fs checks, then fails WebAssembly parsing and leaks the file's leading bytes in the resulting Node/Deno error message. Exploitation requires a network-reachable dev server (localhost-bound by default, so exposure via 0.0.0.0 binding, proxying, or a shared network is a precondition); no public exploit code exists in the provided data and CISA KEV does not list it, while the assessed impact is limited confidentiality loss given only 4 bytes leak per request.
Vite development servers can be induced to serve a single file from outside the project root after import analysis records a root-relative browser URL, rather than the cleaned resolved module identifier, in the internal safeModulePaths trust list. Only non-Windows hosts running a network-accessible dev server (not a production build) are affected, and only when server.fs.deny does not already block the target file; because the colliding path must correspond to a project-relative URL authorized by the application graph, arbitrary path traversal is not achievable and impact is limited to read disclosure with no integrity or availability effect. Exploitation requires the coincidence of an imported project file whose URL matches an absolute host path plus attacker access to the exposed dev server, which the independent assessment scores as higher complexity (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N); no public exploit code was identified at time of analysis.
A crafted request URL containing leading double slashes can cause the Vite development server to emit a protocol-relative module URL in transformed HTML, so a victim's browser fetches and executes an attacker-hosted module inside the Vite-served page. Only applications built on custom middleware that forwards an unchanged browser request URL into server.transformIndexHtml are affected, and the exposure is limited to the dev server rather than production builds; the impacted code paths exist in Vite before 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; exploitation additionally requires a victim developer to actively load the malicious page, which keeps real-world risk LOW.
Argument injection in launch-editor (prior to 2.14.2), the Node.js 'open file in editor' helper shipped with Vite and vite-plus, allows an unauthenticated attacker who can place a file whose name begins with '+' or '-' into the project working directory to have that name interpreted as a command-line flag by the selected editor. When the reachable editor is Vim/gVim, MacVim, Emacs/Emacsclient, or Notepad++ with a plugin exposing dangerous operations, and the path stays relative (or is converted to a relative WSL path), this can lead to unintended file overwrite or arbitrary command execution in the developer's context. Exploitation is heavily preconditioned - the malicious filesystem entry must already exist, a vulnerable editor must be the configured one, and VS Code or absolute-path invocations are unaffected - so per the independent assessment it is rated AC:H with limited (low) confidentiality, integrity, and availability impact rather than a straightforward RCE; no public exploit code has been identified at time of analysis.
OS command injection on Windows in the launch-editor npm package before 2.14.2 lets remote attackers who can influence an environment variable value or a file path containing '%' trigger cmd.exe variable expansion and execute arbitrary commands when the open-in-editor feature is invoked. The flaw is rated medium severity (CVSS 4.0 base 6.3; CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) and is limited to Windows developer workstations using Vite or Vite Plus dev-server tooling; no public exploit identified at time of analysis.
launch-editor allows users to open files with line numbers in editor from Node.js. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Arbitrary remote code execution in @vitejs/plugin-rsc 0.5.5 and earlier lets unauthenticated network attackers run JavaScript with Node.js privileges on a running Vite development server that uses React Server Components and exposes server-function endpoints. The flaw lives in the development-mode dynamic import path used by loadServerAction, decodeReply, and decodeAction, which accepts attacker-controlled references (including data: URL modules) supplied via the x-rsc-action header and request body; a public proof-of-concept exploit exists in the GitHub Security Advisory, though EPSS rates near-term exploitation likelihood low at 0.81% (56th percentile) and it is not in CISA KEV. Impact is confined to development servers - production builds are unaffected - but risk rises sharply when developers run 'vite --host', exposing the port on all network interfaces.
Vite is a frontend tooling framework for JavaScript. Rated low severity (CVSS 2.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Vite is a frontend tooling framework for JavaScript. Rated low severity (CVSS 2.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Vite is a frontend tooling framework for javascript. Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and EPSS exploitation probability 89.0%.
Vite is a frontend tooling framework for javascript. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Vite is a frontend tooling framework for javascript. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Vite is a website frontend framework. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Vite provides frontend tooling. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Vitejs Vite before v2.9.13 was discovered to allow attackers to perform a directory traversal via a crafted URL to the victim's service. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.