vite vulnerabilities (TuxCare)
26 vulnerabilities.
-
viteTuxCare Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine 6.3 Medium -
viteTuxCare Vite: Cross origin script execution through Vite custom middleware 2.1 Low -
viteTuxCare launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors 6.3 Medium -
viteTuxCare launch-editor: escapeCmdArgs() omits % escaping on Windows 6.3 Medium -
viteTuxCare launch-editor: `fs.existsSync()` existence check can be bypassed on Windows 7.5 High -
viteTuxCare NTLMv2 hash disclosure via UNC path handling on Windows 5.5 Medium -
viteTuxCare Vite: `server.fs.deny` bypass on Windows alternate paths 8.2 High -
viteTuxCare launch-editor vulnerable to command injection via the crafted request on Windows 7.5 High -
viteTuxCare Vite has a Path Traversal in Optimized Deps `.map` Handling 6.3 Medium -
viteTuxCare Vite has a `server.fs.deny` bypass with queries 8.2 High -
viteTuxCare Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket 8.2 High -
viteTuxCare vite allows server.fs.deny bypass via backslash on Windows 6.0 Medium -
viteTuxCare Vite's `server.fs` settings were not applied to HTML files 2.3 Low -
viteTuxCare Vite middleware may serve files starting with the same name with the public directory 2.3 Low -
viteTuxCare Vite's server.fs.deny bypassed with /. for files under project root 6.0 Medium -
viteTuxCare Vite has an `server.fs.deny` bypass with an invalid `request-target` 6.0 Medium -
viteTuxCare Vite allows server.fs.deny to be bypassed with .svg or relative paths 5.3 Medium -
viteTuxCare Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query 5.3 Medium -
viteTuxCare Vite bypasses server.fs.deny when using `?raw??` 5.3 Medium -
viteTuxCare Vite allows any websites to send any requests to the development server and read the response 6.5 Medium -
viteTuxCare DOM Clobbering gadget found in vite bundled scripts that leads to XSS in Vite 6.4 Medium -
viteTuxCare server.fs.deny bypassed when using ?import&raw in vite 4.8 Medium -
viteTuxCare Vite's `server.fs.deny` did not deny requests for patterns with directories 5.9 Medium -
viteTuxCare Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem 7.5 High -
viteTuxCare Cross-site Scripting in `server.transformIndexHtml` via URL payload in vite 6.1 Medium -
viteTuxCare TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option 6.1 Medium