Vite XSS vulnerability in `server.transformIndexHtml` via URL payload

Description

When Vite’s HTML transformation is invoked manually via server.transformIndexHtml, the original request URL is passed in unmodified, and the html being transformed contains inline module scripts (<script type="module">...</script>), it is possible to inject arbitrary HTML into the transformed output by supplying a malicious URL query string to server.transformIndexHtml.

Recommendation

Update the vite package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 5.0.0, < 5.0.5

  = 4.5.0

  >= 4.4.0, < 4.4.12**

• Patched version(s): **5.0.5

  4.5.1

  4.4.12**

References

• GHSA-92r3-m2mg-pj97
• CVE-2023-49293
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Vite allows server.fs.deny to be bypassed with .svg or relative paths - CVE-2025-31486
• CodeceptJS's incomprehensive sanitation can lead to Command Injection - CVE-2025-57285
• DuckDB NPM packages 1.3.3 and 1.29.2 briefly compromised with malware - CVE-2025-59037
• Vite middleware may serve files starting with the same name with the public directory - CVE-2025-58751

Tags:

npm

vite