Vite XSS vulnerability in `server.transformIndexHtml` via URL payload

Description

When Vite’s HTML transformation is invoked manually via server.transformIndexHtml, the original request URL is passed in unmodified, and the html being transformed contains inline module scripts (<script type="module">...</script>), it is possible to inject arbitrary HTML into the transformed output by supplying a malicious URL query string to server.transformIndexHtml.

Recommendation

Update the vite package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 5.0.0, < 5.0.5

  = 4.5.0

  >= 4.4.0, < 4.4.12**

• Patched version(s): **5.0.5

  4.5.1

  4.4.12**

References

• GHSA-92r3-m2mg-pj97
• CVE-2023-49293
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Vite allows server.fs.deny to be bypassed with .svg or relative paths - CVE-2025-31486
• Vite's `server.fs` settings were not applied to HTML files - CVE-2025-58752
• Payload does not invalidate JWTs after log out (GHSA-5v66-m237-hwf7) 2 - CVE-2025-4643
• The AuthKit React Router Library rendered sensitive auth data in HTML - CVE-2025-55008

Tags:

npm

vite