Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query
- Severity:
- Medium
Description
The contents of arbitrary files can be returned to the browser.
Recommendation
Update the vite package to the latest compatible version. Followings are version details:
Affected version(s): **< 4.5.11 >= 5.0.0, < 5.4.16 >= 6.0.0, < 6.0.13 >= 6.1.0, < 6.1.3 >= 6.2.0, < 6.2.4** Patched version(s): **4.5.11 5.4.16 6.0.13 6.1.3 6.2.4**
References
Related Issues
- Regular Expression Denial of Service (ReDoS) in lodash (GHSA-x5rq-j2xg-h7qm) 3 - CVE-2019-1010266
- Vite middleware may serve files starting with the same name with the public directory - CVE-2025-58751
- Vite's `server.fs` settings were not applied to HTML files - CVE-2025-58752
- Vite's server.fs.deny bypassed with /. for files under project root - CVE-2025-46565
- Tags:
- npm
- vite
Anything's wrong? Let us know Last updated on March 31, 2025