Vite before v2.9.13 vulnerable to directory traversal via crafted URL to victim's service

Description

Vite before v2.9.13 was discovered to allow attackers to perform a directory traversal via a crafted URL to the victim’s service.

Recommendation

Update the vite package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 3.0.0-alpha.0, < 3.0.0-beta.4

  < 2.9.13**

• Patched version(s): **3.0.0-beta.4

  2.9.13**

References

• GHSA-mv48-hcvh-8jj8
• CVE-2022-35204
• CWE-22
• CAPEC-310
• OWASP 2021-A1
• OWASP 2021-A6

Related Issues

• JOSE vulnerable to resource exhaustion via specifically crafted JWE - jose-browser-runtime - CVE-2022-36083
• Cube Core is vulnerable to Denial of Service (DoS) via crafted request - CVE-2026-25957
• JOSE vulnerable to resource exhaustion via specifically crafted JWE - jose-node-cjs-runtime - CVE-2022-36083
• JOSE vulnerable to resource exhaustion via specifically crafted JWE - jose-node-esm-runtime - CVE-2022-36083

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

10 Secure Coding Best Practices to Follow in Every Project

Update Cheat Sheet for Developers

Tags:

npm

vite