Vite allows server.fs.deny to be bypassed with .svg or relative paths
- Severity:
- Medium
Description
The contents of arbitrary files can be returned to the browser.
Recommendation
Update the vite package to the latest compatible version. Followings are version details:
Affected version(s): **< 4.5.12 >= 5.0.0, < 5.4.17 >= 6.0.0, < 6.0.14 >= 6.1.0, < 6.1.4 >= 6.2.0, < 6.2.5** Patched version(s): **4.5.12 5.4.17 6.0.14 6.1.4 6.2.5**
References
Related Issues
- Vite XSS vulnerability in `server.transformIndexHtml` via URL payload - CVE-2023-49293
- Vite middleware may serve files starting with the same name with the public directory - CVE-2025-58751
- Vite's `server.fs` settings were not applied to HTML files - CVE-2025-58752
- Payload does not invalidate JWTs after log out (GHSA-5v66-m237-hwf7) 2 - CVE-2025-4643
- Tags:
- npm
- vite
Anything's wrong? Let us know Last updated on April 30, 2025