vite vulnerabilities (npm)
27 vulnerabilities.
-
vitenpm Vite: `server.fs.deny` bypassed with queries 6.9 Medium -
vitenpm Vite: First 4 bytes of files outside of `server.fs` setting is exposed by `?vite-wasm-instance` 6.3 Medium -
vitenpm Vite: Files outside `server.fs.allow` could be served when project paths match system paths on non-Windows machine 6.3 Medium -
vitenpm Vite: Cross origin script execution through Vite custom middleware 2.1 Low -
vitenpm launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors 6.3 Medium -
vitenpm launch-editor: escapeCmdArgs() omits % escaping on Windows 6.3 Medium -
vitenpm launch-editor: `fs.existsSync()` existence check can be bypassed on Windows 7.5 High -
vitenpm NTLMv2 hash disclosure via UNC path handling on Windows 5.5 Medium -
vitenpm Vite: `server.fs.deny` bypass on Windows alternate paths 8.2 High -
vitenpm launch-editor vulnerable to command injection via the crafted request on Windows 7.5 High -
vitenpm Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket 8.2 High -
vitenpm vite allows server.fs.deny bypass via backslash on Windows 6.0 Medium -
vitenpm Vite's `server.fs` settings were not applied to HTML files 2.3 Low -
vitenpm Vite middleware may serve files starting with the same name with the public directory 2.3 Low -
vitenpm Vite's server.fs.deny bypassed with /. for files under project root 6.0 Medium -
vitenpm Vite has an `server.fs.deny` bypass with an invalid `request-target` 6.0 Medium -
vitenpm Vite allows server.fs.deny to be bypassed with .svg or relative paths 5.3 Medium -
vitenpm Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query 5.3 Medium -
vitenpm Vite bypasses server.fs.deny when using `?raw??` 5.3 Medium -
vitenpm Vite allows any websites to send any requests to the development server and read the response 6.5 Medium -
vitenpm DOM Clobbering gadget found in vite bundled scripts that leads to XSS in Vite 6.4 Medium -
vitenpm server.fs.deny bypassed when using ?import&raw in vite 4.8 Medium -
vitenpm Vite's `server.fs.deny` did not deny requests for patterns with directories 5.9 Medium -
vitenpm Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem 7.5 High -
vitenpm Cross-site Scripting in `server.transformIndexHtml` via URL payload in vite 6.1 Medium -
vitenpm Vite Server Options (server.fs.deny) can be bypassed using double forward-slash (//) 7.5 High -
vitenpm Vite before v2.9.13 vulnerable to directory traversal via crafted URL to victim's service 4.3 Medium