Vitejs
Monthly
Path-validation bypass in launch-editor before 2.14.2 on Windows allows unauthenticated remote attackers to pass a crafted file:line:column argument that resolves to an existing parent directory and slips past the library's filename-existence check. The bypass does not by itself execute code; it becomes an OS command injection risk only when chained with the separately described Windows percent-expansion flaw, and exploitation requires user interaction plus a reachable launch-editor-middleware endpoint such as a Vite dev server. No public exploit was identified at time of analysis, and the issue is fixed in 2.14.2.
Vite is a frontend tooling framework for javascript. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required. Actively exploited in the wild (cisa kev) and public exploit code available.
Vitest dev servers in versions 5.0.0-beta.6 through 5.0.4 misapply Vite's server.fs.deny denylist, letting remote attackers who can reach a Vitest UI, Browser Mode, or API server read project files that should have been blocked and retrieve the fallback API token stored at node_modules/.vitest/.vitest-secret-token. A second variant, requiring Browser Mode with test.projects and a victim visiting an attacker-controlled site, leaks JavaScript-compatible .env values. No public exploit code or active exploitation has been identified at time of analysis, and the practical exposure is limited because these are development-only servers typically bound to localhost; the fix ships in Vitest 5.0.5.
A path-traversal information-disclosure flaw in Vite's development server (versions 8.2.0 through 8.2.3 and 8.3.0 through 8.3.2) lets a remote requester read the first 4 bytes of any file on the host filesystem - including files deliberately excluded from server.fs allowed roots, such as .env secrets and private keys - by appending a ?vite-wasm-instance query string to the request path. The internal Wasm plugin's load hook strips the query, reads the target path directly from disk without applying server.fs checks, then fails WebAssembly parsing and leaks the file's leading bytes in the resulting Node/Deno error message. Exploitation requires a network-reachable dev server (localhost-bound by default, so exposure via 0.0.0.0 binding, proxying, or a shared network is a precondition); no public exploit code exists in the provided data and CISA KEV does not list it, while the assessed impact is limited confidentiality loss given only 4 bytes leak per request.
Vite development servers can be induced to serve a single file from outside the project root after import analysis records a root-relative browser URL, rather than the cleaned resolved module identifier, in the internal safeModulePaths trust list. Only non-Windows hosts running a network-accessible dev server (not a production build) are affected, and only when server.fs.deny does not already block the target file; because the colliding path must correspond to a project-relative URL authorized by the application graph, arbitrary path traversal is not achievable and impact is limited to read disclosure with no integrity or availability effect. Exploitation requires the coincidence of an imported project file whose URL matches an absolute host path plus attacker access to the exposed dev server, which the independent assessment scores as higher complexity (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N); no public exploit code was identified at time of analysis.
A crafted request URL containing leading double slashes can cause the Vite development server to emit a protocol-relative module URL in transformed HTML, so a victim's browser fetches and executes an attacker-hosted module inside the Vite-served page. Only applications built on custom middleware that forwards an unchanged browser request URL into server.transformIndexHtml are affected, and the exposure is limited to the dev server rather than production builds; the impacted code paths exist in Vite before 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; exploitation additionally requires a victim developer to actively load the malicious page, which keeps real-world risk LOW.
Argument injection in launch-editor (prior to 2.14.2), the Node.js 'open file in editor' helper shipped with Vite and vite-plus, allows an unauthenticated attacker who can place a file whose name begins with '+' or '-' into the project working directory to have that name interpreted as a command-line flag by the selected editor. When the reachable editor is Vim/gVim, MacVim, Emacs/Emacsclient, or Notepad++ with a plugin exposing dangerous operations, and the path stays relative (or is converted to a relative WSL path), this can lead to unintended file overwrite or arbitrary command execution in the developer's context. Exploitation is heavily preconditioned - the malicious filesystem entry must already exist, a vulnerable editor must be the configured one, and VS Code or absolute-path invocations are unaffected - so per the independent assessment it is rated AC:H with limited (low) confidentiality, integrity, and availability impact rather than a straightforward RCE; no public exploit code has been identified at time of analysis.
OS command injection on Windows in the launch-editor npm package before 2.14.2 lets remote attackers who can influence an environment variable value or a file path containing '%' trigger cmd.exe variable expansion and execute arbitrary commands when the open-in-editor feature is invoked. The flaw is rated medium severity (CVSS 4.0 base 6.3; CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) and is limited to Windows developer workstations using Vite or Vite Plus dev-server tooling; no public exploit identified at time of analysis.
launch-editor allows users to open files with line numbers in editor from Node.js. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Vite is a frontend tooling framework for JavaScript. Rated low severity (CVSS 2.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Vite is a frontend tooling framework for JavaScript. Rated low severity (CVSS 2.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Vite is a frontend tooling framework for javascript. Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and EPSS exploitation probability 89.0%.
Vite is a frontend tooling framework for javascript. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Vite is a frontend tooling framework for javascript. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Vite is a website frontend framework. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Vite provides frontend tooling. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Vitejs Vite before v2.9.13 was discovered to allow attackers to perform a directory traversal via a crafted URL to the victim's service. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Path-validation bypass in launch-editor before 2.14.2 on Windows allows unauthenticated remote attackers to pass a crafted file:line:column argument that resolves to an existing parent directory and slips past the library's filename-existence check. The bypass does not by itself execute code; it becomes an OS command injection risk only when chained with the separately described Windows percent-expansion flaw, and exploitation requires user interaction plus a reachable launch-editor-middleware endpoint such as a Vite dev server. No public exploit was identified at time of analysis, and the issue is fixed in 2.14.2.
Vite is a frontend tooling framework for javascript. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required. Actively exploited in the wild (cisa kev) and public exploit code available.
Vitest dev servers in versions 5.0.0-beta.6 through 5.0.4 misapply Vite's server.fs.deny denylist, letting remote attackers who can reach a Vitest UI, Browser Mode, or API server read project files that should have been blocked and retrieve the fallback API token stored at node_modules/.vitest/.vitest-secret-token. A second variant, requiring Browser Mode with test.projects and a victim visiting an attacker-controlled site, leaks JavaScript-compatible .env values. No public exploit code or active exploitation has been identified at time of analysis, and the practical exposure is limited because these are development-only servers typically bound to localhost; the fix ships in Vitest 5.0.5.
A path-traversal information-disclosure flaw in Vite's development server (versions 8.2.0 through 8.2.3 and 8.3.0 through 8.3.2) lets a remote requester read the first 4 bytes of any file on the host filesystem - including files deliberately excluded from server.fs allowed roots, such as .env secrets and private keys - by appending a ?vite-wasm-instance query string to the request path. The internal Wasm plugin's load hook strips the query, reads the target path directly from disk without applying server.fs checks, then fails WebAssembly parsing and leaks the file's leading bytes in the resulting Node/Deno error message. Exploitation requires a network-reachable dev server (localhost-bound by default, so exposure via 0.0.0.0 binding, proxying, or a shared network is a precondition); no public exploit code exists in the provided data and CISA KEV does not list it, while the assessed impact is limited confidentiality loss given only 4 bytes leak per request.
Vite development servers can be induced to serve a single file from outside the project root after import analysis records a root-relative browser URL, rather than the cleaned resolved module identifier, in the internal safeModulePaths trust list. Only non-Windows hosts running a network-accessible dev server (not a production build) are affected, and only when server.fs.deny does not already block the target file; because the colliding path must correspond to a project-relative URL authorized by the application graph, arbitrary path traversal is not achievable and impact is limited to read disclosure with no integrity or availability effect. Exploitation requires the coincidence of an imported project file whose URL matches an absolute host path plus attacker access to the exposed dev server, which the independent assessment scores as higher complexity (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N); no public exploit code was identified at time of analysis.
A crafted request URL containing leading double slashes can cause the Vite development server to emit a protocol-relative module URL in transformed HTML, so a victim's browser fetches and executes an attacker-hosted module inside the Vite-served page. Only applications built on custom middleware that forwards an unchanged browser request URL into server.transformIndexHtml are affected, and the exposure is limited to the dev server rather than production builds; the impacted code paths exist in Vite before 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3. There is no public exploit identified at time of analysis and the issue is not in CISA KEV; exploitation additionally requires a victim developer to actively load the malicious page, which keeps real-world risk LOW.
Argument injection in launch-editor (prior to 2.14.2), the Node.js 'open file in editor' helper shipped with Vite and vite-plus, allows an unauthenticated attacker who can place a file whose name begins with '+' or '-' into the project working directory to have that name interpreted as a command-line flag by the selected editor. When the reachable editor is Vim/gVim, MacVim, Emacs/Emacsclient, or Notepad++ with a plugin exposing dangerous operations, and the path stays relative (or is converted to a relative WSL path), this can lead to unintended file overwrite or arbitrary command execution in the developer's context. Exploitation is heavily preconditioned - the malicious filesystem entry must already exist, a vulnerable editor must be the configured one, and VS Code or absolute-path invocations are unaffected - so per the independent assessment it is rated AC:H with limited (low) confidentiality, integrity, and availability impact rather than a straightforward RCE; no public exploit code has been identified at time of analysis.
OS command injection on Windows in the launch-editor npm package before 2.14.2 lets remote attackers who can influence an environment variable value or a file path containing '%' trigger cmd.exe variable expansion and execute arbitrary commands when the open-in-editor feature is invoked. The flaw is rated medium severity (CVSS 4.0 base 6.3; CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L) and is limited to Windows developer workstations using Vite or Vite Plus dev-server tooling; no public exploit identified at time of analysis.
launch-editor allows users to open files with line numbers in editor from Node.js. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Vite is a frontend tooling framework for JavaScript. Rated low severity (CVSS 2.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Vite is a frontend tooling framework for JavaScript. Rated low severity (CVSS 2.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Vite is a frontend tooling framework for javascript. Rated medium severity (CVSS 6.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and EPSS exploitation probability 89.0%.
Vite is a frontend tooling framework for javascript. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Vite is a frontend tooling framework for javascript. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Vite is a website frontend framework. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Vite provides frontend tooling. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Vitejs Vite before v2.9.13 was discovered to allow attackers to perform a directory traversal via a crafted URL to the victim's service. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.