{"id":"CVE-2025-62522","aliases":["CLSA-2026-1775089661","CLSA-2026-1777249675","CLSA-2026-1777250301","CLSA-2026-1777509608","CLSA-2026-1777855413","CLSA-2026-1777855416","CLSA-2026-1779065186","CLSA-2026-1783558962","CLSA-2026-1790458381","CLSA-2026-1791806508","CLSA-2026-1791807914","CLSA-2026-1791897792","CLSA-2026-1792161447","CLSA-2026-1792161548","CLSA-2026-1792161587","CLSA-2026-1792161688","CLSA-2026-1792161779","CLSA-2026-1792161810","CLSA-2026-1792161850","CLSA-2026-1792161923","CLSA-2026-1792225950","CLSA-2026-1792225951","EUVD-2025-35099","GHSA-4w7w-66w2-5vf9","GHSA-93m4-6634-74q7","GHSA-v2wj-q39q-566r","ROOT-APP-NPM-CVE-2025-62522"],"status":"published","title":"vite allows server.fs.deny bypass via backslash on Windows","description":"Vite is a frontend tooling framework for JavaScript. In versions from 2.9.18 to before 3.0.0, 3.2.9 to before 4.0.0, 4.5.3 to before 5.0.0, 5.2.6 to before 5.4.21, 6.0.0 to before 6.4.1, 7.0.0 to before 7.0.8, and 7.1.0 to before 7.1.11, files denied by server.fs.deny were sent if the URL ended with \\ when the dev server is running on Windows. Only apps explicitly exposing the Vite dev server to the network and running the dev server on Windows were affected. This issue has been patched in versions 5.4.21, 6.4.1, 7.0.8, and 7.1.11.","severity":{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.01054,"percentile":0.64813,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-180","CWE-200","CWE-22","CWE-284"],"published":"2025-10-20T19:54:28Z","modified":"2026-11-04T10:46:01Z","exploits":[{"source":"nuclei","id":"CVE-2025-62522","title":"Vite - Information Disclosure","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-62522.yaml"}],"fixes":[{"ecosystem":"npm","package":"vite","fixed_in":["8.0.5","7.3.2","6.4.2","7.1.11","7.0.8","6.4.1","3.0.0","4.0.0","5.0.0","5.4.21"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"@vitejs/plugin-legacy","fixed_in":["4.5.5-tuxcare.7"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"create-vite","fixed_in":["4.5.5-tuxcare.7"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"vite","fixed_in":["4.5.5-tuxcare.7","4.1.5-tuxcare.2","5.0.12-tuxcare.5"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@astrojs/db","fixed_in":["5.18.1-tuxcare.3"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@astrojs/rss","fixed_in":["5.18.1-tuxcare.3"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@astrojs/telemetry","fixed_in":["5.18.1-tuxcare.3"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"astro","fixed_in":["5.18.1-tuxcare.3"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"create-astro","fixed_in":["5.18.1-tuxcare.3"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"nuxt","fixed_in":["3.12.4-tuxcare.6"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@nuxt/kit","fixed_in":["3.12.4-tuxcare.6"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@astrojs/internal-helpers","fixed_in":["5.18.1-tuxcare.3"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@nuxt/schema","fixed_in":["3.12.4-tuxcare.6"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@astrojs/prism","fixed_in":["5.18.1-tuxcare.3"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@astrojs/underscore-redirects","fixed_in":["5.18.1-tuxcare.3"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@nuxt/vite-builder","fixed_in":["3.12.4-tuxcare.6"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@astrojs/upgrade","fixed_in":["5.18.1-tuxcare.3"],"sources":["osv"]},{"ecosystem":"TuxCare:npm","package":"@nuxt/webpack-builder","fixed_in":["3.12.4-tuxcare.6"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"last_affected":"8.0.4"},{"fixed":"8.0.5"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"last_affected":"7.3.1"},{"fixed":"7.3.2"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.4.1"},{"fixed":"6.4.2"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.1.0"},{"last_affected":"7.1.10"},{"fixed":"7.1.11"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"last_affected":"7.0.7"},{"fixed":"7.0.8"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"last_affected":"6.4.0"},{"fixed":"6.4.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.18"},{"fixed":"3.0.0"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.9"},{"fixed":"4.0.0"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.3"},{"fixed":"5.0.0"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.6"},{"last_affected":"5.4.20"},{"fixed":"5.4.21"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.0"},{"last_affected":"8.0.4"},{"fixed":"8.0.5"}]}]},{"source":"ghsa","ecosystem":"npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.1.0"},{"last_affected":"7.3.1"},{"fixed":"7.3.2"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@vitejs/plugin-legacy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.4.14-tuxcare.0"},{"fixed":"5.4.14-tuxcare.1"}]}],"versions":["5.4.14"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.4.14-tuxcare.0"},{"fixed":"5.4.14-tuxcare.1"}]}],"versions":["5.4.14"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.4.14-tuxcare.0"},{"fixed":"5.4.14-tuxcare.2"}]}],"versions":["5.4.14","5.4.14-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"@vitejs/plugin-legacy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.5-tuxcare.0"},{"fixed":"4.5.5-tuxcare.7"}]}],"versions":["4.5.5","4.5.5-tuxcare.1","4.5.5-tuxcare.2","4.5.5-tuxcare.3","4.5.5-tuxcare.4","4.5.5-tuxcare.5","4.5.5-tuxcare.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"create-vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.5-tuxcare.0"},{"fixed":"4.5.5-tuxcare.7"}]}],"versions":["4.5.5","4.5.5-tuxcare.1","4.5.5-tuxcare.2","4.5.5-tuxcare.3","4.5.5-tuxcare.4","4.5.5-tuxcare.5","4.5.5-tuxcare.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.5-tuxcare.0"},{"fixed":"4.5.5-tuxcare.7"}]}],"versions":["4.5.5","4.5.5-tuxcare.1","4.5.5-tuxcare.2","4.5.5-tuxcare.3","4.5.5-tuxcare.4","4.5.5-tuxcare.5","4.5.5-tuxcare.6"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.18-tuxcare.0"},{"fixed":"2.9.18-tuxcare.1"}]}],"versions":["2.9.18"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.11-tuxcare.0"},{"fixed":"3.2.11-tuxcare.2"}]}],"versions":["3.2.11","3.2.11-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.14-tuxcare.0"},{"fixed":"4.5.14-tuxcare.1"}]}],"versions":["4.5.14"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/db","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.18.1-tuxcare.0"},{"fixed":"5.18.1-tuxcare.3"}]}],"versions":["5.18.1","5.18.1-tuxcare.1","5.18.1-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/rss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.18.1-tuxcare.0"},{"fixed":"5.18.1-tuxcare.3"}]}],"versions":["5.18.1","5.18.1-tuxcare.1","5.18.1-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/telemetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.18.1-tuxcare.0"},{"fixed":"5.18.1-tuxcare.3"}]}],"versions":["5.18.1","5.18.1-tuxcare.1","5.18.1-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"astro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.18.1-tuxcare.0"},{"fixed":"5.18.1-tuxcare.3"}]}],"versions":["5.18.1","5.18.1-tuxcare.1","5.18.1-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"create-astro","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.18.1-tuxcare.0"},{"fixed":"5.18.1-tuxcare.3"}]}],"versions":["5.18.1","5.18.1-tuxcare.1","5.18.1-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"nuxt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.4-tuxcare.0"},{"fixed":"3.12.4-tuxcare.6"}]}],"versions":["3.12.4","3.12.4-tuxcare.2","3.12.4-tuxcare.3","3.12.4-tuxcare.4","3.12.4-tuxcare.5"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.1.5-tuxcare.0"},{"fixed":"4.1.5-tuxcare.2"}]}],"versions":["4.1.5","4.1.5-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.12-tuxcare.0"},{"fixed":"5.0.12-tuxcare.5"}]}],"versions":["5.0.12","5.0.12-tuxcare.1","5.0.12-tuxcare.2","5.0.12-tuxcare.3","5.0.12-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.5.0-tuxcare.0"},{"fixed":"4.5.0-tuxcare.2"}]}],"versions":["4.5.0","4.5.0-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"vite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.4.10-tuxcare.0"},{"fixed":"5.4.10-tuxcare.4"}]}],"versions":["5.4.10","5.4.10-tuxcare.1","5.4.10-tuxcare.2","5.4.10-tuxcare.3"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/kit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.4-tuxcare.0"},{"fixed":"3.12.4-tuxcare.6"}]}],"versions":["3.12.4","3.12.4-tuxcare.2","3.12.4-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/internal-helpers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.18.1-tuxcare.0"},{"fixed":"5.18.1-tuxcare.3"}]}],"versions":["5.18.1","5.18.1-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/schema","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.4-tuxcare.0"},{"fixed":"3.12.4-tuxcare.6"}]}],"versions":["3.12.4","3.12.4-tuxcare.2","3.12.4-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/prism","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.18.1-tuxcare.0"},{"fixed":"5.18.1-tuxcare.3"}]}],"versions":["5.18.1","5.18.1-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/underscore-redirects","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.18.1-tuxcare.0"},{"fixed":"5.18.1-tuxcare.3"}]}],"versions":["5.18.1","5.18.1-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/vite-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.4-tuxcare.0"},{"fixed":"3.12.4-tuxcare.6"}]}],"versions":["3.12.4","3.12.4-tuxcare.2","3.12.4-tuxcare.3"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@astrojs/upgrade","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.18.1-tuxcare.0"},{"fixed":"5.18.1-tuxcare.3"}]}],"versions":["5.18.1","5.18.1-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@nuxt/webpack-builder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.4-tuxcare.0"},{"fixed":"3.12.4-tuxcare.6"}]}],"versions":["3.12.4","3.12.4-tuxcare.2","3.12.4-tuxcare.3","3.12.4-tuxcare.4","3.12.4-tuxcare.5"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@vitejs/plugin-react","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.18-tuxcare.0"},{"fixed":"2.9.18-tuxcare.1"}]}],"versions":["2.9.18"],"bundled":11},{"source":"osv","ecosystem":"TuxCare:npm","package":"@vitejs/plugin-react","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.2.11-tuxcare.0"},{"fixed":"3.2.11-tuxcare.2"}]}],"versions":["3.2.11","3.2.11-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"8.0.5"}]}]},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.3.2"}]}]},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"6.4.2"}]}]},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"7.1.0"},{"fixed":"7.1.11"}]}]},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"7.0.0"},{"fixed":"7.0.8"}]}]},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"6.0.0"},{"fixed":"6.4.1"}]}]},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"2.9.18"},{"fixed":"5.4.21"}]}]},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"3.2.9"},{"fixed":"5.4.21"}]}]},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"4.5.3"},{"fixed":"5.4.21"}]}]},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"5.2.6"},{"fixed":"5.4.21"}]}]},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"8.0.0"},{"fixed":"8.0.5"}]}]},{"source":"osv","ecosystem":"npm","package":"vite","ranges":[{"type":"SEMVER","events":[{"introduced":"7.1.0"},{"fixed":"7.3.2"}]}]}],"products":[{"vendor":"vitejs","product":"vite"}],"references":[{"url":"https://github.com/vitejs/vite/security/advisories/GHSA-93m4-6634-74q7","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/vitejs/vite/commit/f479cc57c425ed41ceb434fecebd63931b1ed4ed","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/vitejs/vite/security/advisories/GHSA-4w7w-66w2-5vf9","tags":["web"]},{"url":"https://github.com/vitejs/vite/pull/22161","tags":["web"]},{"url":"https://github.com/vitejs/vite/commit/79f002f2286c03c88c7b74c511c7f9fc6dc46694","tags":["web"]},{"url":"https://github.com/vitejs/vite/releases/tag/v6.4.2","tags":["web"]},{"url":"https://github.com/vitejs/vite/releases/tag/v7.3.2","tags":["web"]},{"url":"https://github.com/vitejs/vite/releases/tag/v8.0.5","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39365","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4w7w-66w2-5vf9"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62522","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-93m4-6634-74q7"},{"url":"https://github.com/vitejs/vite/security/advisories/GHSA-v2wj-q39q-566r","tags":["web"]},{"url":"https://github.com/vitejs/vite/pull/22160","tags":["web"]},{"url":"https://github.com/vitejs/vite/commit/a9a3df299378d9cbc5f069e3536a369f8188c8ff","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39364","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-v2wj-q39q-566r"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62522.json","tags":["advisory"]},{"url":"https://github.com/vitejs/vite","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-62522","title":"vite allows server.fs.deny bypass via backslash on Windows","description":"Vite is a frontend tooling framework for JavaScript. In versions from 2.9.18 to before 3.0.0, 3.2.9 to before 4.0.0, 4.5.3 to before 5.0.0, 5.2.6 to before 5.4.21, 6.0.0 to before 6.4.1, 7.0.0 to before 7.0.8, and 7.1.0 to before 7.1.11, files denied by server.fs.deny were sent if the URL ended with \\ when the dev server is running on Windows. Only apps explicitly exposing the Vite dev server to the network and running the dev server on Windows were affected. This issue has been patched in versions 5.4.21, 6.4.1, 7.0.8, and 7.1.11.","status":"published","published":"2025-10-20T19:57:13.188Z","modified":"2025-10-20T20:17:08.287Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:32:54.87586Z"}],"euvd":[{"id":"EUVD-2025-35099","description":"Vite is a frontend tooling framework for JavaScript. In versions from 2.9.18 to before 3.0.0, 3.2.9 to before 4.0.0, 4.5.3 to before 5.0.0, 5.2.6 to before 5.4.21, 6.0.0 to before 6.4.1, 7.0.0 to before 7.0.8, and 7.1.0 to before 7.1.11, files denied by server.fs.deny were sent if the URL ended with \\ when the dev server is running on Windows. Only apps explicitly exposing the Vite dev server to the network and running the dev server on Windows were affected. This issue has been patched in versions 5.4.21, 6.4.1, 7.0.8, and 7.1.11.","status":"published","published":"2025-10-20T19:57:13Z","modified":"2025-10-20T20:17:08Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T20:31:29.921127Z"}],"ghsa":[{"id":"GHSA-4w7w-66w2-5vf9","title":"Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling","description":"### Summary\n\nAny files ending with `.map` even out side the project can be returned to the browser.\n\n### Impact\n\nOnly apps that match the following conditions are affected:\n\n- explicitly exposes the Vite dev server to the network (using `--host` or [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host))\n- have a sensitive content in files ending with `.map` and the path is predictable\n\n### Details\n\nIn Vite v7.3.1, the dev server’s handling of `.map` requests for optimized dependencies resolves file paths and calls `readFile` without restricting `../` segments in the URL. As a result, it is possible to bypass the [`server.fs.strict`](https://vite.dev/config/server-options#server-fs-strict) allow list and retrieve `.map` files located outside the project root, provided they can be parsed as valid source map JSON.\n\n### PoC\n1. Create a minimal PoC sourcemap outside the project root\n    ```bash\n    cat \u003e /tmp/poc.map \u003c\u003c'EOF'\n    {\"version\":3,\"file\":\"x.js\",\"sources\":[],\"names\":[],\"mappings\":\"\"}\n    EOF\n    ```\n2. Start the Vite dev server (example)\n    ```bash\n    pnpm -C playground/fs-serve dev --host 127.0.0.1 --port 18080\n    ```\n3. Confirm that direct `/@fs` access is blocked by `strict` (returns 403)\n    \u003cimg width=\"4004\" height=\"1038\" alt=\"image\" src=\"https://github.com/user-attachments/assets/15a859a8-1dc6-4105-8d58-80527c0dd9ab\" /\u003e\n4. Inject `../` segments under the optimized deps `.map` URL prefix to reach `/tmp/poc.map`\n    \u003cimg width=\"2790\" height=\"846\" alt=\"image\" src=\"https://github.com/user-attachments/assets/5d02957d-2e6a-4c45-9819-3f024e0e81f2\" /\u003e","status":"published","published":"2026-04-06T18:03:46Z","modified":"2026-04-07T22:16:29Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-22","CWE-200"],"updated_at":"2026-11-02T14:39:51.193071Z"},{"id":"GHSA-93m4-6634-74q7","title":"vite allows server.fs.deny bypass via backslash on Windows","description":"### Summary\nFiles denied by [`server.fs.deny`](https://vitejs.dev/config/server-options.html#server-fs-deny) were sent if the URL ended with `\\` when the dev server is running on Windows.\n\n### Impact\nOnly apps that match the following conditions are affected:\n\n- explicitly exposes the Vite dev server to the network (using --host or [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host))\n- running the dev server on Windows\n\n### Details\n`server.fs.deny` can contain patterns matching against files (by default it includes `.env`, `.env.*`, `*.{crt,pem}` as such patterns). These patterns were able to bypass by using a back slash(`\\`). The root cause is that `fs.readFile('/foo.png/')` loads `/foo.png`.\n\n### PoC\n```shell\nnpm create vite@latest\ncd vite-project/\ncat \"secret\" \u003e .env\nnpm install\nnpm run dev\ncurl --request-target /.env\\ http://localhost:5173\n```\n\u003cimg width=\"1593\" height=\"616\" alt=\"image\" src=\"https://github.com/user-attachments/assets/36212f4e-1d3c-4686-b16f-16b35ca9e175\" /\u003e","status":"published","published":"2025-10-20T19:54:28Z","modified":"2025-10-21T14:51:26Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:39:01.677422Z"},{"id":"GHSA-v2wj-q39q-566r","title":"Vite: `server.fs.deny` bypassed with queries","description":"### Summary\n\nThe contents of files that are specified by [`server.fs.deny`](https://vite.dev/config/server-options#server-fs-deny) can be returned to the browser.\n\n### Impact\n\nOnly apps that match the following conditions are affected:\n\n- explicitly exposes the Vite dev server to the network (using `--host` or [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host))\n- the sensitive file exists in the allowed directories specified by [`server.fs.allow`](https://vite.dev/config/server-options#server-fs-allow)\n- the sensitive file is denied with a pattern that matches a file by [`server.fs.deny`](https://vite.dev/config/server-options#server-fs-deny)\n\n### Details\n\nOn the Vite dev server, files that should be blocked by `server.fs.deny` (e.g., `.env`, `*.crt`) can be retrieved with HTTP 200 responses when query parameters such as `?raw`, `?import\u0026raw`, or `?import\u0026url\u0026inline` are appended.\n\n### PoC\n\n1. Start the dev server: `pnpm exec vite root --host 127.0.0.1 --port 5175 --strictPort`\n2. Confirm that `server.fs.deny` is enforced (expect 403): `curl -i http://127.0.0.1:5175/src/.env | head -n 20`\n   \u003cimg width=\"3944\" height=\"1092\" alt=\"image\" src=\"https://github.com/user-attachments/assets/ecb9f2e0-e08f-4ac7-b194-e0f988c4cd4f\" /\u003e\n3. Confirm that the same files can be retrieved with query parameters (expect 200):\n   \u003cimg width=\"2014\" height=\"373\" alt=\"image\" src=\"https://github.com/user-attachments/assets/76bc2a6a-44f4-4161-ae47-eab5ae0c04a8\" /\u003e","status":"published","published":"2026-04-06T18:03:32Z","modified":"2026-04-07T22:16:19Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-180","CWE-284"],"updated_at":"2026-11-02T14:39:51.193071Z"}],"nvd":[{"id":"CVE-2025-62522","description":"Vite is a frontend tooling framework for JavaScript. In versions from 2.9.18 to before 3.0.0, 3.2.9 to before 4.0.0, 4.5.3 to before 5.0.0, 5.2.6 to before 5.4.21, 6.0.0 to before 6.4.1, 7.0.0 to before 7.0.8, and 7.1.0 to before 7.1.11, files denied by server.fs.deny were sent if the URL ended with \\ when the dev server is running on Windows. Only apps explicitly exposing the Vite dev server to the network and running the dev server on Windows were affected. This issue has been patched in versions 5.4.21, 6.4.1, 7.0.8, and 7.1.11.","status":"published","published":"2025-10-20T20:15:37.427Z","modified":"2026-10-08T22:10:00.563Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:11:39.069866Z"}],"osv":[{"id":"CVE-2025-62522","title":"vite allows server.fs.deny bypass via backslash on Windows","description":"Vite is a frontend tooling framework for JavaScript. In versions from 2.9.18 to before 3.0.0, 3.2.9 to before 4.0.0, 4.5.3 to before 5.0.0, 5.2.6 to before 5.4.21, 6.0.0 to before 6.4.1, 7.0.0 to before 7.0.8, and 7.1.0 to before 7.1.11, files denied by server.fs.deny were sent if the URL ended with \\ when the dev server is running on Windows. Only apps explicitly exposing the Vite dev server to the network and running the dev server on Windows were affected. This issue has been patched in versions 5.4.21, 6.4.1, 7.0.8, and 7.1.11.","status":"published","published":"2025-10-20T19:57:13.188Z","modified":"2026-11-04T10:46:01.829816815Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-04T11:07:13.540858Z"},{"id":"GHSA-4w7w-66w2-5vf9","title":"Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling","description":"### Summary\n\nAny files ending with `.map` even out side the project can be returned to the browser.\n\n### Impact\n\nOnly apps that match the following conditions are affected:\n\n- explicitly exposes the Vite dev server to the network (using `--host` or [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host))\n- have a sensitive content in files ending with `.map` and the path is predictable\n\n### Details\n\nIn Vite v7.3.1, the dev server’s handling of `.map` requests for optimized dependencies resolves file paths and calls `readFile` without restricting `../` segments in the URL. As a result, it is possible to bypass the [`server.fs.strict`](https://vite.dev/config/server-options#server-fs-strict) allow list and retrieve `.map` files located outside the project root, provided they can be parsed as valid source map JSON.\n\n### PoC\n1. Create a minimal PoC sourcemap outside the project root\n    ```bash\n    cat \u003e /tmp/poc.map \u003c\u003c'EOF'\n    {\"version\":3,\"file\":\"x.js\",\"sources\":[],\"names\":[],\"mappings\":\"\"}\n    EOF\n    ```\n2. Start the Vite dev server (example)\n    ```bash\n    pnpm -C playground/fs-serve dev --host 127.0.0.1 --port 18080\n    ```\n3. Confirm that direct `/@fs` access is blocked by `strict` (returns 403)\n    \u003cimg width=\"4004\" height=\"1038\" alt=\"image\" src=\"https://github.com/user-attachments/assets/15a859a8-1dc6-4105-8d58-80527c0dd9ab\" /\u003e\n4. Inject `../` segments under the optimized deps `.map` URL prefix to reach `/tmp/poc.map`\n    \u003cimg width=\"2790\" height=\"846\" alt=\"image\" src=\"https://github.com/user-attachments/assets/5d02957d-2e6a-4c45-9819-3f024e0e81f2\" /\u003e","status":"published","published":"2026-04-06T18:03:46Z","modified":"2026-09-10T03:50:42.779400319Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-200","CWE-22"],"updated_at":"2026-11-02T15:46:37.528068Z"},{"id":"GHSA-93m4-6634-74q7","title":"vite allows server.fs.deny bypass via backslash on Windows","description":"### Summary\nFiles denied by [`server.fs.deny`](https://vitejs.dev/config/server-options.html#server-fs-deny) were sent if the URL ended with `\\` when the dev server is running on Windows.\n\n### Impact\nOnly apps that match the following conditions are affected:\n\n- explicitly exposes the Vite dev server to the network (using --host or [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host))\n- running the dev server on Windows\n\n### Details\n`server.fs.deny` can contain patterns matching against files (by default it includes `.env`, `.env.*`, `*.{crt,pem}` as such patterns). These patterns were able to bypass by using a back slash(`\\`). The root cause is that `fs.readFile('/foo.png/')` loads `/foo.png`.\n\n### PoC\n```shell\nnpm create vite@latest\ncd vite-project/\ncat \"secret\" \u003e .env\nnpm install\nnpm run dev\ncurl --request-target /.env\\ http://localhost:5173\n```\n\u003cimg width=\"1593\" height=\"616\" alt=\"image\" src=\"https://github.com/user-attachments/assets/36212f4e-1d3c-4686-b16f-16b35ca9e175\" /\u003e","status":"published","published":"2025-10-20T19:54:28Z","modified":"2026-09-10T03:50:29.574857832Z","cvss":[{"version":"4.0","score":6,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:43.123867Z"},{"id":"GHSA-v2wj-q39q-566r","title":"Vite: `server.fs.deny` bypassed with queries","description":"### Summary\n\nThe contents of files that are specified by [`server.fs.deny`](https://vite.dev/config/server-options#server-fs-deny) can be returned to the browser.\n\n### Impact\n\nOnly apps that match the following conditions are affected:\n\n- explicitly exposes the Vite dev server to the network (using `--host` or [`server.host` config option](https://vitejs.dev/config/server-options.html#server-host))\n- the sensitive file exists in the allowed directories specified by [`server.fs.allow`](https://vite.dev/config/server-options#server-fs-allow)\n- the sensitive file is denied with a pattern that matches a file by [`server.fs.deny`](https://vite.dev/config/server-options#server-fs-deny)\n\n### Details\n\nOn the Vite dev server, files that should be blocked by `server.fs.deny` (e.g., `.env`, `*.crt`) can be retrieved with HTTP 200 responses when query parameters such as `?raw`, `?import\u0026raw`, or `?import\u0026url\u0026inline` are appended.\n\n### PoC\n\n1. Start the dev server: `pnpm exec vite root --host 127.0.0.1 --port 5175 --strictPort`\n2. Confirm that `server.fs.deny` is enforced (expect 403): `curl -i http://127.0.0.1:5175/src/.env | head -n 20`\n   \u003cimg width=\"3944\" height=\"1092\" alt=\"image\" src=\"https://github.com/user-attachments/assets/ecb9f2e0-e08f-4ac7-b194-e0f988c4cd4f\" /\u003e\n3. Confirm that the same files can be retrieved with query parameters (expect 200):\n   \u003cimg width=\"2014\" height=\"373\" alt=\"image\" src=\"https://github.com/user-attachments/assets/76bc2a6a-44f4-4161-ae47-eab5ae0c04a8\" /\u003e","status":"published","published":"2026-04-06T18:03:32Z","modified":"2026-09-10T03:50:44.780128889Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-180","CWE-284"],"updated_at":"2026-11-02T15:46:56.639206Z"},{"id":"ROOT-APP-NPM-CVE-2025-62522","title":"CVE-2025-62522 in @rootio/vite - Patched by Root","description":"Root has patched CVE-2025-62522 in the @rootio/vite package for Root:npm. Multiple fixed versions available.","status":"withdrawn","published":"2026-07-02T07:59:38Z","modified":"2026-07-29T08:00:21.289929873Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:27.362922Z"},{"id":"CLSA-2026-1775089661","title":"TuxCare security update for 2 packages (5 CVEs)","description":"TuxCare rebuilt 2 packages to address 5 CVEs. Fixed in 5.4.14-tuxcare.1.","status":"published","published":"2026-08-04T14:52:20Z","modified":"2026-10-15T09:47:49.386394056Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1777249675","title":"TuxCare security update for vite (4 CVEs)","description":"TuxCare rebuilt vite to address 4 CVEs. Fixed in 5.4.14-tuxcare.2.","status":"published","published":"2026-08-04T14:52:20Z","modified":"2026-10-29T19:45:49.018347409Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1777250301","title":"TuxCare security update for 3 packages (3 CVEs)","description":"TuxCare rebuilt 3 packages to address 3 CVEs. Fixed in 4.5.5-tuxcare.7.","status":"published","published":"2026-08-04T14:52:28Z","modified":"2026-10-15T09:45:47.673175453Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1777509608","title":"TuxCare security update for vite (11 CVEs)","description":"TuxCare rebuilt vite to address 11 CVEs. Fixed in 2.9.18-tuxcare.1.","status":"published","published":"2026-08-04T14:52:29Z","modified":"2026-10-29T19:45:49.027696506Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1777855413","title":"TuxCare security update for vite (4 CVEs)","description":"TuxCare rebuilt vite to address 4 CVEs. Fixed in 3.2.11-tuxcare.2.","status":"published","published":"2026-08-04T14:52:30Z","modified":"2026-10-29T19:45:48.953312654Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1777855416","title":"TuxCare security update for vite (4 CVEs)","description":"TuxCare rebuilt vite to address 4 CVEs. Fixed in 4.5.14-tuxcare.1.","status":"published","published":"2026-08-04T14:52:30Z","modified":"2026-10-29T19:45:48.640046753Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1779065186","title":"TuxCare security update for 5 packages (1 CVE)","description":"TuxCare rebuilt 5 packages to address 1 CVE. Fixed in 5.18.1-tuxcare.3.","status":"published","published":"2026-08-04T14:52:32Z","modified":"2026-10-15T09:45:27.694876229Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1783558962","title":"TuxCare security update for nuxt (1 CVE)","description":"TuxCare rebuilt nuxt to address 1 CVE. Fixed in 3.12.4-tuxcare.6.","status":"published","published":"2026-08-04T14:52:42Z","modified":"2026-10-15T09:48:03.716164063Z","updated_at":"2026-11-02T15:43:46.151924Z"},{"id":"CLSA-2026-1790458381","title":"TuxCare security update for vite (1 CVE)","description":"TuxCare rebuilt vite to address 1 CVE. Fixed in 4.1.5-tuxcare.2.","status":"published","published":"2026-09-26T21:33:01Z","modified":"2026-10-15T09:47:57.001534259Z","updated_at":"2026-11-02T15:43:48.65893Z"},{"id":"CLSA-2026-1791806508","title":"TuxCare security update for vite (1 CVE)","description":"TuxCare rebuilt vite to address 1 CVE. Fixed in 5.0.12-tuxcare.5.","status":"published","published":"2026-10-12T12:01:48Z","modified":"2026-10-15T09:47:40.330508046Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791807914","title":"TuxCare security update for vite (3 CVEs)","description":"TuxCare rebuilt vite to address 3 CVEs. Fixed in 4.5.0-tuxcare.2.","status":"published","published":"2026-10-12T12:25:14Z","modified":"2026-10-15T09:47:40.2438322Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791897792","title":"TuxCare security update for vite (8 CVEs)","description":"TuxCare rebuilt vite to address 8 CVEs. Fixed in 5.4.10-tuxcare.4.","status":"published","published":"2026-10-13T13:23:12Z","modified":"2026-10-15T09:47:53.554887486Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1792161447","title":"TuxCare security update for @nuxt/kit (1 CVE)","description":"TuxCare rebuilt @nuxt/kit to address 1 CVE. Fixed in 3.12.4-tuxcare.6.","status":"published","published":"2026-10-16T14:37:27Z","modified":"2026-10-16T16:30:31.361482994Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161548","title":"TuxCare security update for @astrojs/internal-helpers (1 CVE)","description":"TuxCare rebuilt @astrojs/internal-helpers to address 1 CVE. Fixed in 5.18.1-tuxcare.3.","status":"published","published":"2026-10-16T14:39:08Z","modified":"2026-10-16T16:30:09.083250162Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161587","title":"TuxCare security update for @nuxt/schema (1 CVE)","description":"TuxCare rebuilt @nuxt/schema to address 1 CVE. Fixed in 3.12.4-tuxcare.6.","status":"published","published":"2026-10-16T14:39:47Z","modified":"2026-10-16T16:31:27.162335569Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161688","title":"TuxCare security update for @astrojs/prism (1 CVE)","description":"TuxCare rebuilt @astrojs/prism to address 1 CVE. Fixed in 5.18.1-tuxcare.3.","status":"published","published":"2026-10-16T14:41:28Z","modified":"2026-10-16T16:31:13.848509274Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161779","title":"TuxCare security update for @astrojs/underscore-redirects (1 CVE)","description":"TuxCare rebuilt @astrojs/underscore-redirects to address 1 CVE. Fixed in 5.18.1-tuxcare.3.","status":"published","published":"2026-10-16T14:42:59Z","modified":"2026-10-16T16:31:09.67526972Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161810","title":"TuxCare security update for @nuxt/vite-builder (1 CVE)","description":"TuxCare rebuilt @nuxt/vite-builder to address 1 CVE. Fixed in 3.12.4-tuxcare.6.","status":"published","published":"2026-10-16T14:43:30Z","modified":"2026-10-16T16:30:33.699574208Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161850","title":"TuxCare security update for @astrojs/upgrade (1 CVE)","description":"TuxCare rebuilt @astrojs/upgrade to address 1 CVE. Fixed in 5.18.1-tuxcare.3.","status":"published","published":"2026-10-16T14:44:10Z","modified":"2026-10-16T16:31:15.705133383Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792161923","title":"TuxCare security update for @nuxt/webpack-builder (1 CVE)","description":"TuxCare rebuilt @nuxt/webpack-builder to address 1 CVE. Fixed in 3.12.4-tuxcare.6.","status":"published","published":"2026-10-16T14:45:23Z","modified":"2026-10-16T16:30:53.130872172Z","updated_at":"2026-11-02T15:43:51.213191Z"},{"id":"CLSA-2026-1792225950","title":"TuxCare security update for @vitejs/plugin-react (11 CVEs)","description":"TuxCare rebuilt @vitejs/plugin-react to address 11 CVEs. Fixed in 2.9.18-tuxcare.1.","status":"published","published":"2026-10-17T08:32:30Z","modified":"2026-10-17T13:09:25.089676995Z","updated_at":"2026-11-02T15:43:52.011757Z"},{"id":"CLSA-2026-1792225951","title":"TuxCare security update for @vitejs/plugin-react (4 CVEs)","description":"TuxCare rebuilt @vitejs/plugin-react to address 4 CVEs. Fixed in 3.2.11-tuxcare.2.","status":"published","published":"2026-10-17T08:32:30Z","modified":"2026-10-17T13:09:22.76794299Z","updated_at":"2026-11-02T15:43:52.011757Z"}]}}